Fonts: Office's downloaded fonts are used; opening a file says which fonts are missing

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

ATTRIBUTION.md

@@ -28,6 +28,8 @@ deck and UI icons are original work of the DeckCraft contributors (drawn or gene
 | `crates/media/tests/fixtures/clip-*` (`clip-h264.mp4`, `clip-h264.mov`, `clip-hevc.mp4`, `clip-vp9.webm`, `clip-av1.mkv`) | DeckCraft contributors | 6 frames of a colour gradient generated by `make.sh` (python3), encoded by ffmpeg (x264 / x265 / libvpx / SVT-AV1 as encoders only) | CC0-1.0 | Video decoding tests |
 | `crates/media/tests/fixtures/make.sh` | DeckCraft contributors | this repository | MIT OR Apache-2.0 | Regenerates the media fixtures |
 | `crates/render/tests/fixtures/colr-squares.ttf` | DeckCraft contributors | two squares as a COLRv0/CPAL test font, built by `make_colr_font.py` (fontTools as the builder only) | CC0-1.0 | Colour glyph rendering tests |
+| `crates/fonts/tests/fixtures/legacy-semibold.ttf` | DeckCraft contributors | a one-glyph Semibold face named like Segoe UI Semibold (its Windows family differs from the typographic one), built by `make_legacy_font.py` (fontTools as the builder only) | CC0-1.0 | Font lookup by Windows family name tests |
+| `crates/fonts/tests/fixtures/legacy-regular.ttf` | DeckCraft contributors | the same family's one-glyph Regular face, built by `make_legacy_font.py` (fontTools as the builder only) | CC0-1.0 | Font lookup by Windows family name tests |
 | `crates/render/tests/fixtures/make_colr_font.py` | DeckCraft contributors | this repository | MIT OR Apache-2.0 | Regenerates the COLR test font |
 
 ## Bundled through dependencies

Cargo.lock

@@ -1046,6 +1046,14 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "deckcraft-metafile"
+version = "0.6.1"
+dependencies = [
+ "kurbo",
+ "thiserror 2.0.21",
+]
+
 [[package]]
 name = "deckcraft-model"
 version = "0.6.1"
@@ -1103,6 +1111,7 @@ dependencies = [
  "deckcraft-color",
  "deckcraft-fonts",
  "deckcraft-geom",
+ "deckcraft-metafile",
  "deckcraft-model",
  "deckcraft-text",
  "image",

Cargo.toml

@@ -14,6 +14,7 @@ repository = "https://github.com/storytold/deckcraft"
 # internal
 deckcraft-geom = { path = "crates/geom" }
 deckcraft-color = { path = "crates/color" }
+deckcraft-metafile = { path = "crates/metafile" }
 deckcraft-model = { path = "crates/model" }
 deckcraft-fonts = { path = "crates/fonts" }
 deckcraft-text = { path = "crates/text" }

crates/engine/src/cmd/file.rs

@@ -79,7 +79,10 @@ pub fn open_presentation(name: &str, bytes: &[u8]) -> Result<Presentation> {
 
 pub fn add_opened(s: &mut Session, name: &str, path: Option<String>, p: Presentation) -> usize {
     let title = std::path::Path::new(name).file_stem().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| name.to_string());
-    s.add_document(DocState::new(p, path, title))
+    let missing_fonts = crate::fonts::missing_fonts(&p);
+    let mut st = DocState::new(p, path, title);
+    st.missing_fonts = missing_fonts;
+    s.add_document(st)
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -89,7 +92,8 @@ fn open(s: &mut Session, p: &Value) -> Result<Value> {
     let doc = open_presentation(path, &bytes)?;
     let native = deckcraft_format::sniff(&bytes) || deckcraft_pptx::sniff(&bytes);
     let i = add_opened(s, path, native.then(|| path.to_string()), doc);
-    Ok(json!({"document": i, "slides": s.doc()?.doc.slides.len()}))
+    let st = s.doc()?;
+    Ok(json!({"document": i, "slides": st.doc.slides.len(), "missingFonts": st.missing_fonts}))
 }
 #[cfg(target_arch = "wasm32")]
 fn open(_s: &mut Session, _p: &Value) -> Result<Value> {
@@ -101,7 +105,7 @@ fn open_bytes(s: &mut Session, p: &Value) -> Result<Value> {
     let data = str_param(p, "data").and_then(base64_decode).ok_or_else(|| bad("file.openBytes", "missing or invalid base64 `data`"))?;
     let doc = open_presentation(name, &data)?;
     let i = add_opened(s, name, None, doc);
-    Ok(json!({"document": i}))
+    Ok(json!({"document": i, "missingFonts": s.doc()?.missing_fonts}))
 }
 
 /// Encode the presentation in `format` (`deckcraft`, `pptx`, `outline`).

crates/engine/src/fonts.rs

@@ -0,0 +1,65 @@
+//! Fonts a presentation uses that this machine doesn't have, so opening it can say so (its text
+//! draws in a stand-in; see `FontDb::document_face`).
+
+use deckcraft_fonts::FontDb;
+use deckcraft_model::resolve::{self, Ctx};
+use deckcraft_model::text::{Bullet, TextBody};
+use deckcraft_model::{Presentation, Shape, ShapeKind};
+
+/// The font families the slides' text is drawn in (theme fonts resolved, bullet fonts included)
+/// that aren't installed or bundled, sorted, without duplicates (case-insensitive).
+pub fn missing_fonts(p: &Presentation) -> Vec<String> {
+    let db = FontDb::global();
+    let mut out: Vec<String> = Vec::new();
+    for family in used_fonts(p) {
+        if !db.has_family(&family) && !out.iter().any(|f| f.eq_ignore_ascii_case(&family)) {
+            out.push(family);
+        }
+    }
+    out.sort_by_key(|f| f.to_lowercase());
+    out
+}
+
+/// The families the slides' text runs and bullets are drawn in.
+fn used_fonts(p: &Presentation) -> Vec<String> {
+    let mut out: Vec<String> = Vec::new();
+    let mut add = |f: String| {
+        let f = f.trim().to_string();
+        if !f.is_empty() && !out.iter().any(|o| o.eq_ignore_ascii_case(&f)) {
+            out.push(f);
+        }
+    };
+    for slide in &p.slides {
+        let Some(ctx) = Ctx::for_slide(p, slide) else { continue };
+        deckcraft_model::walk(&slide.shapes, &mut |s, _| {
+            if let Some(body) = &s.text {
+                body_fonts(&ctx, s, body, &mut add);
+            }
+            if let ShapeKind::Table(t) = &s.kind {
+                for cell in t.rows.iter().flat_map(|r| &r.cells) {
+                    body_fonts(&ctx, s, &cell.text, &mut add);
+                }
+            }
+        });
+    }
+    out
+}
+
+fn body_fonts(ctx: &Ctx, s: &Shape, body: &TextBody, add: &mut dyn FnMut(String)) {
+    for para in &body.paragraphs {
+        let has_text = para.runs.iter().any(|r| !r.text.trim().is_empty());
+        if !has_text {
+            continue;
+        }
+        for run in para.runs.iter().filter(|r| !r.text.trim().is_empty()) {
+            let r = resolve::run(ctx, s, para, &run.props);
+            add(resolve::font_family(ctx, &r));
+        }
+        let pp = resolve::para(ctx, s, para);
+        if matches!(pp.bullet, Some(Bullet::Char { .. }))
+            && let Some(f) = pp.bullet_font.as_deref()
+        {
+            add(ctx.master.theme.font(f));
+        }
+    }
+}

crates/engine/src/lib.rs

@@ -9,6 +9,7 @@
 
 pub mod cmd;
 pub mod connect;
+pub mod fonts;
 pub mod guard;
 pub mod keys;
 pub mod links;
@@ -141,6 +142,9 @@ pub struct DocState {
     pub interaction: Option<Interaction>,
     pub uid: u64,
     pub title: String,
+    /// Fonts the file's text uses that aren't installed, found when it was opened (empty for new
+    /// documents); the app mentions them once.
+    pub missing_fonts: Vec<String>,
 }
 
 static NEXT_UID: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
@@ -158,6 +162,7 @@ impl DocState {
             interaction: None,
             uid: NEXT_UID.fetch_add(1, std::sync::atomic::Ordering::Relaxed),
             title,
+            missing_fonts: Vec::new(),
         }
     }
     pub fn is_dirty(&self) -> bool {

crates/engine/src/tests.rs

@@ -504,6 +504,30 @@ fn hyperlink_on_a_word_or_shape_links_it() {
     assert!(s.doc().unwrap().current_slide().unwrap().shapes[0].click.is_some(), "a selected shape gets the link as its click action");
 }
 
+/// A .pptx (base64) whose first slide's title is set in `font`.
+fn deck_in_font(font: &str) -> String {
+    let mut p = deckcraft_model::Presentation::default();
+    let slide = std::sync::Arc::make_mut(&mut p.slides[0]);
+    let mut body = deckcraft_model::text::TextBody::from_text("Hello");
+    body.paragraphs[0].runs[0].props.font = Some(font.into());
+    slide.shapes[0].text = Some(body);
+    crate::cmd::base64_encode(&crate::cmd::file::save_bytes(&p, "pptx").unwrap())
+}
+
+#[test]
+fn opening_a_file_lists_the_fonts_it_uses_that_are_missing() {
+    let mut s = Session::with_new();
+    let r = s.execute("file.openBytes", &json!({"name": "a.pptx", "data": deck_in_font("Qqq Nonexistent Sans")})).unwrap();
+    assert_eq!(r["missingFonts"], json!(["Qqq Nonexistent Sans"]));
+    assert_eq!(s.doc().unwrap().missing_fonts, vec!["Qqq Nonexistent Sans".to_string()]);
+    // A font that is there (bundled or installed) isn't listed; new documents list nothing.
+    let have = deckcraft_fonts::FontDb::global().face(deckcraft_fonts::FALLBACK_FAMILY, "Regular").family.clone();
+    let r = s.execute("file.openBytes", &json!({"name": "b.pptx", "data": deck_in_font(&have)})).unwrap();
+    assert_eq!(r["missingFonts"], json!([]));
+    s.execute("file.new", &json!({})).unwrap();
+    assert!(s.doc().unwrap().missing_fonts.is_empty());
+}
+
 #[test]
 fn clicks_in_flipped_shapes_hit_the_text_where_it_is_drawn() {
     // Flips don't mirror text, so a click lands on the character drawn under it.

crates/fonts/src/fontdb.rs

@@ -52,6 +52,53 @@ pub fn substitutes(family: &str) -> &'static [&'static str] {
     }
 }
 
+/// Families whose open substitutes ([`substitutes`]) keep their metrics, so text drawn with
+/// them breaks into the same lines.
+fn has_metric_twin(family: &str) -> bool {
+    matches!(
+        family.to_ascii_lowercase().as_str(),
+        "calibri" | "calibri light" | "cambria" | "cambria math" | "arial" | "helvetica" | "times new roman" | "times" | "courier new" | "courier"
+    )
+}
+
+/// The installed family PowerPoint draws a missing `family` with instead of Calibri: Liberation
+/// Sans and Serif as Arial and Times New Roman (observed in PowerPoint; Liberation Mono, Carlito,
+/// Caladea, Arimo and Tinos are not mapped and draw in Calibri), and Windows' standard font
+/// substitutes (Arial CE, Times New Roman CYR…).
+fn office_twin(family: &str) -> Option<&'static str> {
+    let f = family.to_ascii_lowercase();
+    Some(match f.as_str() {
+        "liberation sans" | "helvetica" | "helv" => "Arial",
+        "liberation serif" | "times" | "tms rmn" => "Times New Roman",
+        _ => {
+            let base = f
+                .strip_suffix(" baltic")
+                .or(f.strip_suffix(" ce"))
+                .or(f.strip_suffix(" cyr"))
+                .or(f.strip_suffix(" greek"))
+                .or(f.strip_suffix(" tur"))?;
+            match base {
+                "arial" => "Arial",
+                "courier new" => "Courier New",
+                "times new roman" => "Times New Roman",
+                _ => return None,
+            }
+        }
+    })
+}
+
+/// Office's downloadable (cloud) families: PowerPoint fetches them when a document uses them, so
+/// they draw as themselves there, not as Calibri. Without them DeckCraft keeps their closest open
+/// substitute ([`substitutes`]; Aptos as Inter).
+fn is_office_cloud_font(family: &str) -> bool {
+    let f = family.to_ascii_lowercase();
+    f.starts_with("aptos") || ["bierstadt", "grandview", "seaford", "skeena", "tenorite"].iter().any(|c| f.starts_with(c))
+}
+
+/// The family PowerPoint draws a document's Latin text in when the font it names isn't installed,
+/// whatever the theme, `panose` or `pitchFamily` say.
+pub const MISSING_FONT_FAMILY: &str = "Calibri";
+
 #[derive(Clone)]
 enum FontBytes {
     Static(&'static [u8]),
@@ -65,6 +112,10 @@ pub struct FontFace {
     pub family: String,
     /// Typographic style name (e.g. "Semibold", "Italic").
     pub style: String,
+    /// The Windows (GDI) family and style names (`name` IDs 1 and 2) when the family differs from
+    /// the typographic one: "Segoe UI Semibold" / "Regular" for Segoe UI Semibold. Documents name
+    /// fonts this way.
+    pub legacy: Option<(String, String)>,
     /// usWeightClass-style weight (400 = regular).
     pub weight: f32,
     pub italic: bool,
@@ -253,6 +304,11 @@ pub struct FontDb {
     /// scan, so what they find doesn't depend on what ran before them.
     #[cfg(not(target_arch = "wasm32"))]
     cataloged: std::sync::OnceLock<()>,
+    /// Families (lower case) whose cataloged files have all been loaded: a family's files load
+    /// together, so a lookup never settles for the one face another name loaded ("Segoe UI
+    /// Semibold" loads a face of the family "Segoe UI").
+    #[cfg(not(target_arch = "wasm32"))]
+    loaded_families: Mutex<std::collections::HashSet<String>>,
     /// System fallback state: enabled, and characters no system font covers.
     #[cfg(not(target_arch = "wasm32"))]
     sys: Mutex<SysFallback>,
@@ -316,6 +372,16 @@ fn face_names(f: &skrifa::FontRef<'_>) -> Option<(String, String)> {
     Some((family, style))
 }
 
+/// A face's Windows (GDI) family and style (`name` IDs 1 and 2) when that family differs from the
+/// typographic `family`.
+fn legacy_names(f: &skrifa::FontRef<'_>, family: &str) -> Option<(String, String)> {
+    let legacy = name(f, &[StringId::FAMILY_NAME])?;
+    if legacy.eq_ignore_ascii_case(family) {
+        return None;
+    }
+    Some((legacy, name(f, &[StringId::SUBFAMILY_NAME]).unwrap_or_else(|| "Regular".into())))
+}
+
 /// (family, style) of every face in the font file at `path`, reading only its table directories
 /// and `name` tables: a scan opens hundreds of font files, many of them megabytes long. A
 /// variable font is cataloged under its default style; its named instances appear once it loads.
@@ -362,8 +428,13 @@ fn file_face_names(path: &std::path::Path) -> Vec<(String, String)> {
                 font.extend_from_slice(&u32::to_be_bytes(v));
             }
             font.extend_from_slice(&table);
-            face_names(&skrifa::FontRef::new(&font).ok()?)
+            let f = skrifa::FontRef::new(&font).ok()?;
+            let (family, style) = face_names(&f)?;
+            // Cataloged under its Windows family too, so "Segoe UI Semibold" finds the file.
+            let legacy = legacy_names(&f, &family);
+            Some(std::iter::once((family, style)).chain(legacy))
         })
+        .flatten()
         .collect()
 }
 
@@ -379,6 +450,12 @@ pub fn system_font_dirs() -> Vec<std::path::PathBuf> {
         dirs.extend(["/System/Library/Fonts", "/Library/Fonts"].map(Into::into));
         if let Some(h) = &home {
             dirs.push(h.join("Library/Fonts"));
+            // Fonts Microsoft Office downloads on demand (Aptos…), used where Office put them.
+            dirs.push(h.join("Library/Group Containers/UBF8T346G9.Office/FontCache/4/CloudFonts"));
+        }
+        // Fonts Office installs inside its apps.
+        for app in ["Microsoft PowerPoint", "Microsoft Word", "Microsoft Excel"] {
+            dirs.push(std::path::PathBuf::from(format!("/Applications/{app}.app/Contents/Resources/DFonts")));
         }
         // Fonts macOS ships as assets (PingFang, Yu Mincho, …): com_apple_MobileAsset_Font<N>.
         for parent in ["/System/Library/AssetsV2", "/System/Library/AssetsV2/PreinstalledAssetsV2/InstallWithOs"] {
@@ -393,7 +470,11 @@ pub fn system_font_dirs() -> Vec<std::path::PathBuf> {
         let root = std::env::var_os("WINDIR").map(std::path::PathBuf::from).unwrap_or_else(|| "C:\\Windows".into());
         dirs.push(root.join("Fonts"));
         if let Some(l) = std::env::var_os("LOCALAPPDATA") {
-            dirs.push(std::path::PathBuf::from(l).join("Microsoft\\Windows\\Fonts"));
+            let l = std::path::PathBuf::from(l);
+            dirs.push(l.join("Microsoft\\Windows\\Fonts"));
+            // Fonts Microsoft Office downloads on demand (Aptos…), used where Office put them;
+            // DeckCraft never ships or needs them.
+            dirs.push(l.join("Microsoft\\FontCache\\4\\CloudFonts"));
         }
     } else {
         dirs.extend(["/usr/share/fonts", "/usr/local/share/fonts"].map(Into::into));
@@ -491,10 +572,12 @@ fn make_face(bytes: FontBytes, index: u32, family: String, style: String, coords
         .map(|v| v >= 0.5)
         .or(axis(b"slnt").map(|v| v.abs() > 0.1))
         .unwrap_or(!matches!(a.style, skrifa::attribute::Style::Normal) || style_italic(&style));
+    let legacy = if coords.is_empty() { legacy_names(&f, &family) } else { None };
     Some(FontFace {
         id: NEXT_ID.fetch_add(1, Ordering::Relaxed),
         family,
         style,
+        legacy,
         weight,
         italic,
         upem: m.units_per_em.max(1) as f64,
@@ -571,6 +654,8 @@ impl FontDb {
             #[cfg(not(target_arch = "wasm32"))]
             cataloged: std::sync::OnceLock::new(),
             #[cfg(not(target_arch = "wasm32"))]
+            loaded_families: Mutex::new(std::collections::HashSet::new()),
+            #[cfg(not(target_arch = "wasm32"))]
             sys: Mutex::new(SysFallback { enabled: true, ..Default::default() }),
         }
     }
@@ -676,6 +761,8 @@ impl FontDb {
     /// Returns the number of faces cataloged.
     #[cfg(not(target_arch = "wasm32"))]
     pub fn load_system_fonts(&self) -> usize {
+        // Families load again from the new catalog when next looked up.
+        self.loaded_families.lock().unwrap_or_else(|e| e.into_inner()).clear();
         // The first scan, or a rescan once it is done (never both at once).
         let mut first = None;
         self.cataloged.get_or_init(|| first = Some(self.scan_font_dirs()));
@@ -756,17 +843,35 @@ impl FontDb {
             .unwrap_or_else(last_resort_face)
     }
 
+    /// The face a document's text in `family` is drawn with, as PowerPoint draws it: the family
+    /// when it is installed or bundled, or a metric-compatible stand-in (Carlito for Calibri,
+    /// Liberation Sans for Arial…), or the family PowerPoint maps it to (Liberation Sans as Arial,
+    /// see `office_twin`); any other missing family is drawn in Calibri (or Carlito).
+    /// DeckCraft's own default family keeps [`FontDb::face`]'s fallbacks.
+    pub fn document_face(&self, family: &str, style: &str) -> Arc<FontFace> {
+        if family.eq_ignore_ascii_case(FALLBACK_FAMILY) || has_metric_twin(family) || is_office_cloud_font(family) || self.has_family(family) {
+            return self.face(family, style);
+        }
+        if let Some(twin) = office_twin(family) {
+            return self.face(twin, style);
+        }
+        self.face(MISSING_FONT_FAMILY, style)
+    }
+
     fn try_family(&self, family: &str, style: &str) -> Option<Arc<FontFace>> {
-        if let Some(f) = self.find(family, style) {
-            return Some(f);
-        }
+        // Every installed file of the family first, so the best style is among the candidates. The
+        // lock is held while the files load, so another thread looking up the family waits for
+        // them rather than finding none and falling back to another family.
         #[cfg(not(target_arch = "wasm32"))]
-        if self.load_cataloged(family)
-            && let Some(f) = self.find(family, style)
         {
-            return Some(f);
+            let mut loaded = self.loaded_families.lock().unwrap_or_else(|e| e.into_inner());
+            let key = family.to_lowercase();
+            if !loaded.contains(&key) {
+                self.load_cataloged(family);
+                loaded.insert(key);
+            }
         }
-        None
+        self.find(family, style)
     }
 
     /// Is `family` available (loaded, or installed on the system)?
@@ -782,7 +887,9 @@ impl FontDb {
     }
 
     pub(crate) fn is_loaded(&self, family: &str) -> bool {
-        self.read_faces().iter().any(|f| f.family.eq_ignore_ascii_case(family))
+        self.read_faces()
+            .iter()
+            .any(|f| f.family.eq_ignore_ascii_case(family) || f.legacy.as_ref().is_some_and(|(lf, _)| lf.eq_ignore_ascii_case(family)))
     }
 
     /// A variable font's axes: (tag, name, min, default, max), empty for static fonts.
@@ -837,11 +944,27 @@ impl FontDb {
             return self.instance(family, style);
         }
         let faces = self.read_faces();
-        let cands: Vec<&Arc<FontFace>> = faces.iter().filter(|f| f.family.eq_ignore_ascii_case(family)).collect();
+        let mut cands: Vec<&Arc<FontFace>> = faces.iter().filter(|f| f.family.eq_ignore_ascii_case(family)).collect();
+        let ns = norm(style);
+        if cands.is_empty() {
+            // A Windows family name ("Segoe UI Semibold", "Arial Black"): its faces, matched by
+            // their Windows style ("Regular", "Bold"…).
+            cands = faces.iter().filter(|f| f.legacy.as_ref().is_some_and(|(lf, _)| lf.eq_ignore_ascii_case(family))).collect();
+            if let Some(f) = cands.iter().find(|f| f.legacy.as_ref().is_some_and(|(_, ls)| norm(ls) == ns)) {
+                return Some((*f).clone());
+            }
+            // Bold of a family that is itself a weight (Semibold, Light): the face, made bolder
+            // by the caller, as Windows does, rather than a face of another weight.
+            if let Some(f) = cands
+                .iter()
+                .find(|f| f.legacy.as_ref().is_some_and(|(_, ls)| norm(ls) == norm(if style_italic(style) { "Italic" } else { "Regular" })))
+            {
+                return Some((*f).clone());
+            }
+        }
         if cands.is_empty() {
             return None;
         }
-        let ns = norm(style);
         if let Some(f) = cands.iter().find(|f| norm(&f.style) == ns) {
             return Some((*f).clone());
         }

crates/fonts/src/lib.rs

@@ -14,7 +14,9 @@ pub mod script;
 mod shape;
 
 pub use fallback::{bundled_families, covers_cluster, is_emoji_cluster, ligature_carets};
-pub use fontdb::{FALLBACK_FAMILY, FaceRef, FontDb, FontFace, LAST_RESORT_FAMILY, base_style, bundled, substitutes, system_font_dirs};
+pub use fontdb::{
+    FALLBACK_FAMILY, FaceRef, FontDb, FontFace, LAST_RESORT_FAMILY, MISSING_FONT_FAMILY, base_style, bundled, substitutes, system_font_dirs,
+};
 pub use harfrust::Feature;
 use harfrust::Tag;
 pub use kurbo::BezPath;
@@ -182,6 +184,65 @@ mod tests {
         assert!(!shape(&f, "Hello", &[], |c| c).is_empty());
     }
 
+    #[test]
+    fn windows_family_names_find_their_faces() {
+        // Documents name fonts by their Windows family ("Segoe UI Semibold"); the font's
+        // typographic family is "Segoe UI" with a "Semibold" style. The fixture is named the same way.
+        let check = |db: &FontDb| {
+            assert!(db.has_family("DeckCraft Legacy Semibold"));
+            for style in ["Regular", "Bold"] {
+                let f = db.face("DeckCraft Legacy Semibold", style);
+                assert_eq!((f.family.as_str(), f.style.as_str()), ("DeckCraft Legacy", "Semibold"), "{style}");
+            }
+            assert_eq!(db.document_face("DeckCraft Legacy Semibold", "Regular").family, "DeckCraft Legacy", "installed, so not Calibri");
+            // The typographic name still works.
+            assert_eq!(db.face("DeckCraft Legacy", "Semibold").style, "Semibold");
+        };
+        // Loaded directly…
+        let db = FontDb::with_font_dirs(Vec::new());
+        db.set_system_fallback(false);
+        assert_eq!(db.add_font(include_bytes!("../tests/fixtures/legacy-semibold.ttf").to_vec()), 1);
+        check(&db);
+        // …and found by the system font scan under its Windows name, then loaded.
+        #[cfg(not(target_arch = "wasm32"))]
+        {
+            let dir = std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures");
+            let db = FontDb::with_font_dirs(vec![dir.clone()]);
+            db.set_system_fallback(false);
+            check(&db);
+            // Looking up the Windows name loads the Semibold file only; a later lookup of the
+            // family's Regular must still load and pick the Regular file, not settle for Semibold.
+            let db = FontDb::with_font_dirs(vec![dir]);
+            db.set_system_fallback(false);
+            assert_eq!(db.face("DeckCraft Legacy Semibold", "Regular").style, "Semibold");
+            let regular = db.face("DeckCraft Legacy", "Regular");
+            assert_eq!((regular.style.as_str(), regular.weight), ("Regular", 400.0));
+        }
+    }
+
+    #[test]
+    fn missing_document_fonts_are_drawn_in_calibri() {
+        // PowerPoint draws a missing family in Calibri, whatever its panose or the theme says.
+        let db = FontDb::global();
+        for missing in ["Qqq Nonexistent", "Avenir Next Qqq", "", "Arimo Qqq"] {
+            let f = db.document_face(missing, "Bold");
+            assert_eq!(f.family, db.face(MISSING_FONT_FAMILY, "Bold").family, "{missing:?}");
+        }
+        // PowerPoint's own twins and Windows' substitutes, when the font itself is missing.
+        for (missing, twin) in
+            [("Liberation Sans", "Arial"), ("Liberation Serif", "Times New Roman"), ("Arial CE", "Arial"), ("Times New Roman CYR", "Times New Roman")]
+        {
+            if !db.has_family(missing) {
+                assert_eq!(db.document_face(missing, "Regular").family, db.face(twin, "Regular").family, "{missing}");
+            }
+        }
+        // Metric-compatible stand-ins and DeckCraft's default keep their own fallbacks.
+        // So do Office's cloud fonts, which PowerPoint downloads and draws as themselves.
+        for kept in ["Arial", "Times New Roman", "Cambria", "Courier New", FALLBACK_FAMILY, "Aptos", "Aptos Display", "Grandview"] {
+            assert_eq!(db.document_face(kept, "Regular").family, db.face(kept, "Regular").family, "{kept}");
+        }
+    }
+
     #[test]
     fn office_fonts_have_substitutes() {
         assert!(substitutes("Calibri").contains(&"Carlito"));

crates/fonts/tests/fixtures/make_legacy_font.py

@@ -0,0 +1,55 @@
+"""Build the legacy-name test font: DeckCraft Legacy Semibold (contributor-original, CC0-1.0).
+
+Usage: python make_legacy_font.py legacy-semibold.ttf legacy-regular.ttf  (needs fontTools)
+
+legacy-semibold.ttf: typographic family "DeckCraft Legacy", style "Semibold" (name IDs 16/17,
+weight 600); Windows family "DeckCraft Legacy Semibold", style "Regular" (name IDs 1/2), as fonts
+like Segoe UI Semibold are named. legacy-regular.ttf: the family's Regular ("DeckCraft Legacy",
+"Regular", weight 400), named only by IDs 1/2 as Segoe UI's regular file is. Glyphs: .notdef and
+a square for "A".
+"""
+import sys
+
+from fontTools.fontBuilder import FontBuilder
+from fontTools.pens.ttGlyphPen import TTGlyphPen
+
+
+def square():
+    pen = TTGlyphPen(None)
+    pen.moveTo((100, 0))
+    pen.lineTo((100, 700))
+    pen.lineTo((600, 700))
+    pen.lineTo((600, 0))
+    pen.closePath()
+    return pen.glyph()
+
+
+def build(path, names, weight):
+    fb = FontBuilder(1000, isTTF=True)
+    fb.setupGlyphOrder([".notdef", "A"])
+    fb.setupCharacterMap({ord("A"): "A"})
+    fb.setupGlyf({".notdef": TTGlyphPen(None).glyph(), "A": square()})
+    fb.setupHorizontalMetrics({".notdef": (500, 0), "A": (700, 100)})
+    fb.setupHorizontalHeader(ascent=800, descent=-200)
+    fb.setupNameTable(names)
+    fb.setupOS2(usWeightClass=weight, sTypoAscender=800, sTypoDescender=-200, usWinAscent=800, usWinDescent=200)
+    fb.setupPost()
+    fb.save(path)
+
+
+build(sys.argv[1], {
+    "familyName": "DeckCraft Legacy Semibold",
+    "styleName": "Regular",
+    "typographicFamily": "DeckCraft Legacy",
+    "typographicSubfamily": "Semibold",
+    "uniqueFontIdentifier": "DeckCraft Legacy Semibold",
+    "fullName": "DeckCraft Legacy Semibold",
+    "psName": "DeckCraftLegacy-Semibold",
+}, 600)
+build(sys.argv[2], {
+    "familyName": "DeckCraft Legacy",
+    "styleName": "Regular",
+    "uniqueFontIdentifier": "DeckCraft Legacy Regular",
+    "fullName": "DeckCraft Legacy",
+    "psName": "DeckCraftLegacy-Regular",
+}, 400)

crates/geom/src/preset.rs

@@ -9,6 +9,8 @@
 use kurbo::{Arc, BezPath, Point, Rect, Shape as _, Vec2};
 use serde::{Deserialize, Serialize};
 
+mod extra;
+
 /// How a sub-path is filled. `Lighten`/`Darken` variants shade the shape's fill (3-D looking faces).
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -148,6 +150,7 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("bentConnector3", "Connector: Elbow", Lines, [50000]),
     p!("curvedConnector3", "Connector: Curved", Lines, [50000]),
     p!("bentConnector2", "Connector: Elbow (one bend)", Lines, []),
+    p!("lineInv", "Line: Rising", Lines, []),
     p!("rect", "Rectangle", Rectangles, []),
     p!("roundRect", "Rectangle: Rounded Corners", Rectangles, [16667]),
     p!("snip1Rect", "Rectangle: Single Corner Snipped", Rectangles, [16667]),
@@ -163,6 +166,7 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("rtTriangle", "Right Triangle", BasicShapes, []),
     p!("parallelogram", "Parallelogram", BasicShapes, [25000]),
     p!("trapezoid", "Trapezoid", BasicShapes, [25000]),
+    p!("nonIsoscelesTrapezoid", "Trapezoid: Uneven Sides", BasicShapes, [25000, 25000]),
     p!("diamond", "Diamond", BasicShapes, []),
     p!("pentagon", "Regular Pentagon", BasicShapes, []),
     p!("hexagon", "Hexagon", BasicShapes, [25000]),
@@ -171,9 +175,13 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("decagon", "Decagon", BasicShapes, []),
     p!("dodecagon", "Dodecagon", BasicShapes, []),
     p!("pie", "Partial Circle", BasicShapes, [0, 16200000]),
+    p!("pieWedge", "Quarter Wedge", BasicShapes, []),
     p!("chord", "Chord", BasicShapes, [2700000, 16200000]),
     p!("teardrop", "Teardrop", BasicShapes, [100000]),
     p!("frame", "Frame", BasicShapes, [12500]),
+    p!("cornerTabs", "Corner Tabs: Triangles", BasicShapes, []),
+    p!("squareTabs", "Corner Tabs: Squares", BasicShapes, []),
+    p!("plaqueTabs", "Corner Tabs: Quarter Circles", BasicShapes, []),
     p!("halfFrame", "Half Frame", BasicShapes, [33333, 33333]),
     p!("corner", "L-Shape", BasicShapes, [50000, 50000]),
     p!("diagStripe", "Diagonal Stripe", BasicShapes, [50000]),
@@ -192,6 +200,9 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("sun", "Sun", BasicShapes, [25000]),
     p!("moon", "Moon", BasicShapes, [50000]),
     p!("cloud", "Cloud", BasicShapes, []),
+    p!("gear6", "Gear: 6 Teeth", BasicShapes, [15000, 3526]),
+    p!("gear9", "Gear: 9 Teeth", BasicShapes, [10000, 1763]),
+    p!("funnel", "Funnel", BasicShapes, []),
     p!("arc", "Arc", BasicShapes, [16200000, 0]),
     p!("bracketPair", "Double Bracket", BasicShapes, [16667]),
     p!("bracePair", "Double Brace", BasicShapes, [8333]),
@@ -199,6 +210,9 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("rightBracket", "Right Bracket", BasicShapes, [8333]),
     p!("leftBrace", "Left Brace", BasicShapes, [8333, 50000]),
     p!("rightBrace", "Right Brace", BasicShapes, [8333, 50000]),
+    p!("chartX", "Chart Marker: Cross Lines", BasicShapes, []),
+    p!("chartStar", "Chart Marker: Star Lines", BasicShapes, []),
+    p!("chartPlus", "Chart Marker: Plus Lines", BasicShapes, []),
     p!("rightArrow", "Arrow: Right", BlockArrows, [50000, 50000]),
     p!("leftArrow", "Arrow: Left", BlockArrows, [50000, 50000]),
     p!("upArrow", "Arrow: Up", BlockArrows, [50000, 50000]),
@@ -209,16 +223,27 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("leftRightUpArrow", "Arrow: Left-Right-Up", BlockArrows, [25000, 25000, 25000]),
     p!("bentArrow", "Arrow: Bent", BlockArrows, [25000, 25000, 25000, 43750]),
     p!("uturnArrow", "Arrow: U-Turn", BlockArrows, [25000, 25000, 25000, 43750, 75000]),
+    p!("curvedRightArrow", "Arrow: Curved Right", BlockArrows, [25000, 50000, 25000]),
+    p!("curvedLeftArrow", "Arrow: Curved Left", BlockArrows, [25000, 50000, 25000]),
+    p!("curvedUpArrow", "Arrow: Curved Up", BlockArrows, [25000, 50000, 25000]),
+    p!("curvedDownArrow", "Arrow: Curved Down", BlockArrows, [25000, 50000, 25000]),
     p!("leftUpArrow", "Arrow: Left-Up", BlockArrows, [25000, 25000, 25000]),
     p!("bentUpArrow", "Arrow: Bent-Up", BlockArrows, [25000, 25000, 25000]),
     p!("stripedRightArrow", "Arrow: Striped Right", BlockArrows, [50000, 50000]),
     p!("notchedRightArrow", "Arrow: Notched Right", BlockArrows, [50000, 50000]),
     p!("homePlate", "Arrow: Pentagon", BlockArrows, [50000]),
     p!("chevron", "Arrow: Chevron", BlockArrows, [50000]),
+    p!("circularArrow", "Arrow: Circular", BlockArrows, [12500, 1142319, 20457681, 10800000, 12500]),
+    p!("leftCircularArrow", "Arrow: Circular Counter-clockwise", BlockArrows, [12500, -1142319, 1142319, 10800000, 12500]),
+    p!("leftRightCircularArrow", "Arrow: Circular Two-headed", BlockArrows, [12500, 1142319, 20457681, 11942319, 12500]),
+    p!("swooshArrow", "Arrow: Swoosh", BlockArrows, [25000, 16667]),
     p!("rightArrowCallout", "Callout: Right Arrow", BlockArrows, [25000, 25000, 25000, 64977]),
     p!("downArrowCallout", "Callout: Down Arrow", BlockArrows, [25000, 25000, 25000, 64977]),
     p!("leftArrowCallout", "Callout: Left Arrow", BlockArrows, [25000, 25000, 25000, 64977]),
     p!("upArrowCallout", "Callout: Up Arrow", BlockArrows, [25000, 25000, 25000, 64977]),
+    p!("leftRightArrowCallout", "Callout: Left-Right Arrow", BlockArrows, [25000, 25000, 25000, 48123]),
+    p!("upDownArrowCallout", "Callout: Up-Down Arrow", BlockArrows, [25000, 25000, 25000, 48123]),
+    p!("quadArrowCallout", "Callout: Quad Arrow", BlockArrows, [18515, 18515, 18515, 48123]),
     p!("mathPlus", "Plus Sign", EquationShapes, [23520]),
     p!("mathMinus", "Minus Sign", EquationShapes, [23520]),
     p!("mathMultiply", "Multiplication Sign", EquationShapes, [23520]),
@@ -253,6 +278,7 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("flowChartMagneticDisk", "Flowchart: Magnetic Disk", Flowchart, []),
     p!("flowChartMagneticDrum", "Flowchart: Direct Access Storage", Flowchart, []),
     p!("flowChartDisplay", "Flowchart: Display", Flowchart, []),
+    p!("flowChartOfflineStorage", "Flowchart: Offline Storage", Flowchart, []),
     p!("irregularSeal1", "Explosion: 8 Points", StarsAndBanners, []),
     p!("irregularSeal2", "Explosion: 14 Points", StarsAndBanners, []),
     p!("star4", "Star: 4 Points", StarsAndBanners, [12500]),
@@ -267,6 +293,9 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("star32", "Star: 32 Points", StarsAndBanners, [37500]),
     p!("ribbon2", "Ribbon: Tilted Up", StarsAndBanners, [16667, 50000]),
     p!("ribbon", "Ribbon: Tilted Down", StarsAndBanners, [16667, 50000]),
+    p!("ellipseRibbon2", "Ribbon: Curved and Tilted Up", StarsAndBanners, [25000, 50000, 12500]),
+    p!("ellipseRibbon", "Ribbon: Curved and Tilted Down", StarsAndBanners, [25000, 50000, 12500]),
+    p!("leftRightRibbon", "Ribbon: Left-Right Fold", StarsAndBanners, [50000, 50000, 16667]),
     p!("verticalScroll", "Scroll: Vertical", StarsAndBanners, [12500]),
     p!("horizontalScroll", "Scroll: Horizontal", StarsAndBanners, [12500]),
     p!("wave", "Wave", StarsAndBanners, [12500, 0]),
@@ -276,6 +305,22 @@ pub static CATALOG: &[PresetInfo] = &[
     p!("wedgeEllipseCallout", "Speech Bubble: Oval", Callouts, [-20833, 62500]),
     p!("cloudCallout", "Thought Bubble: Cloud", Callouts, [-20833, 62500]),
     p!("borderCallout1", "Callout: Line", Callouts, [18750, -8333, 112500, -38333]),
+    p!("borderCallout2", "Callout: Bent Line", Callouts, [18750, -8333, 18750, -16667, 112500, -46667]),
+    p!("borderCallout3", "Callout: Double Bent Line", Callouts, [18750, -8333, 18750, -16667, 100000, -16667, 112963, -8333]),
+    p!("accentCallout1", "Callout: Line with Accent Bar", Callouts, [18750, -8333, 112500, -38333]),
+    p!("accentCallout2", "Callout: Bent Line with Accent Bar", Callouts, [18750, -8333, 18750, -16667, 112500, -46667]),
+    p!("accentCallout3", "Callout: Double Bent Line with Accent Bar", Callouts, [18750, -8333, 18750, -16667, 100000, -16667, 112963, -8333]),
+    p!("callout1", "Callout: Line with No Border", Callouts, [18750, -8333, 112500, -38333]),
+    p!("callout2", "Callout: Bent Line with No Border", Callouts, [18750, -8333, 18750, -16667, 112500, -46667]),
+    p!("callout3", "Callout: Double Bent Line with No Border", Callouts, [18750, -8333, 18750, -16667, 100000, -16667, 112963, -8333]),
+    p!("accentBorderCallout1", "Callout: Line with Border and Accent Bar", Callouts, [18750, -8333, 112500, -38333]),
+    p!("accentBorderCallout2", "Callout: Bent Line with Border and Accent Bar", Callouts, [18750, -8333, 18750, -16667, 112500, -46667]),
+    p!(
+        "accentBorderCallout3",
+        "Callout: Double Bent Line with Border and Accent Bar",
+        Callouts,
+        [18750, -8333, 18750, -16667, 100000, -16667, 112963, -8333]
+    ),
     p!("actionButtonBackPrevious", "Action Button: Go Back or Previous", ActionButtons, []),
     p!("actionButtonForwardNext", "Action Button: Go Forward or Next", ActionButtons, []),
     p!("actionButtonBeginning", "Action Button: Go to Beginning", ActionButtons, []),
@@ -1535,7 +1580,7 @@ pub fn build(name: &str, w: f64, h: f64, adj: &[f64]) -> Option<Geometry> {
             let l = Pb::new().m(0.0, 0.0).c(x / 2.0, 0.0, x, h / 4.0, x, h / 2.0).c(x, h * 0.75, (x + w) / 2.0, h, w, h).take();
             Geometry { paths: vec![stroke_only(l)], text_rect: full, handles: vec![], sites: vec![Point::ZERO, Point::new(w, h)] }
         }
-        _ => return None,
+        _ => return extra::build(name, w, h, &a),
     };
     Some(g)
 }

crates/geom/src/preset/extra.rs

@@ -0,0 +1,796 @@
+//! More preset outlines: line callouts, arrow callouts, curved and circular arrows, curved
+//! ribbons, gears, tabs and chart markers. Like the rest of `preset`, every outline is our own
+//! construction, fitted to how the shapes look and to what their adjust values mean.
+
+use super::*;
+
+/// Builds the presets this module knows; `None` for any other name.
+pub(super) fn build(name: &str, w: f64, h: f64, a: &dyn Fn(usize) -> f64) -> Option<Geometry> {
+    let ss = w.min(h);
+    let full = Rect::new(0.0, 0.0, w, h);
+    let mut b = Pb::new();
+    let g = match name {
+        "lineInv" => {
+            let l = b.m(0.0, h).l(w, 0.0).take();
+            Geometry { paths: vec![stroke_only(l)], text_rect: full, handles: vec![], sites: vec![Point::new(0.0, h), Point::new(w, 0.0)] }
+        }
+        "nonIsoscelesTrapezoid" => {
+            let max = 50000.0 * w / ss.max(1e-9);
+            let (v1, v2) = (a(0).clamp(0.0, max), a(1).clamp(0.0, max));
+            let (d1, d2) = (ss * v1 / 1e5, ss * v2 / 1e5);
+            let mut g = simple(b.poly(&[(0.0, h), (d1, 0.0), (w - d2, 0.0), (w, h)]).take(), Rect::new(d1 * 0.66, h * 0.2, w - d2 * 0.66, h), w, h);
+            g.handles.push(Handle::new(0, Point::ZERO, Vec2::new(ss / 1e5, 0.0), v1, 0.0, max));
+            g.handles.push(Handle::new(1, Point::new(w, 0.0), Vec2::new(-ss / 1e5, 0.0), v2, 0.0, max));
+            g
+        }
+        "pieWedge" => {
+            b.m(0.0, h).arc(w, h, 180.0, 90.0).l(w, h).z();
+            simple(b.take(), Rect::new(w * 0.29289, h * 0.29289, w, h), w, h)
+        }
+        "flowChartOfflineStorage" => {
+            let tri = b.poly(&[(0.0, 0.0), (w, 0.0), (w / 2.0, h)]).take();
+            let bar = Pb::new().m(w * 0.4, h * 0.8).l(w * 0.6, h * 0.8).take();
+            Geometry {
+                paths: vec![fill(tri), stroke_only(bar)],
+                text_rect: Rect::new(w / 4.0, 0.0, w * 0.75, h * 0.8),
+                handles: vec![],
+                sites: vec![Point::new(w / 2.0, 0.0), Point::new(w / 4.0, h / 2.0), Point::new(w / 2.0, h), Point::new(w * 0.75, h / 2.0)],
+            }
+        }
+        "chartX" | "chartStar" | "chartPlus" => {
+            let body = corner_rect(w, h, [Corner::Square; 4]);
+            let mut l = Pb::new();
+            if name != "chartPlus" {
+                l.m(0.0, 0.0).l(w, h).m(0.0, h).l(w, 0.0);
+            }
+            if name != "chartX" {
+                l.m(w / 2.0, 0.0).l(w / 2.0, h);
+            }
+            if name == "chartPlus" {
+                l.m(0.0, h / 2.0).l(w, h / 2.0);
+            }
+            Geometry { paths: vec![fill_only(body), stroke_only(l.take())], text_rect: full, handles: vec![], sites: mid_sites(w, h) }
+        }
+        "cornerTabs" | "squareTabs" | "plaqueTabs" => {
+            // Each tab's size is a twentieth of the diagonal.
+            let d = (w.hypot(h) / 20.0).min(w / 2.0).min(h / 2.0);
+            match name {
+                "cornerTabs" => {
+                    b.poly(&[(0.0, 0.0), (d, 0.0), (0.0, d)]);
+                    b.poly(&[(w - d, 0.0), (w, 0.0), (w, d)]);
+                    b.poly(&[(w, h - d), (w, h), (w - d, h)]);
+                    b.poly(&[(0.0, h - d), (d, h), (0.0, h)]);
+                }
+                "squareTabs" => {
+                    b.poly(&[(0.0, 0.0), (d, 0.0), (d, d), (0.0, d)]);
+                    b.poly(&[(w - d, 0.0), (w, 0.0), (w, d), (w - d, d)]);
+                    b.poly(&[(w - d, h - d), (w, h - d), (w, h), (w - d, h)]);
+                    b.poly(&[(0.0, h - d), (d, h - d), (d, h), (0.0, h)]);
+                }
+                _ => {
+                    if d > 0.0 {
+                        b.m(0.0, 0.0).l(d, 0.0).arc(d, d, 0.0, 90.0).z();
+                        b.m(w, 0.0).l(w, d).arc(d, d, 90.0, 90.0).z();
+                        b.m(w, h).l(w - d, h).arc(d, d, 180.0, 90.0).z();
+                        b.m(0.0, h).l(0.0, h - d).arc(d, d, 270.0, 90.0).z();
+                    } else {
+                        b.m(0.0, 0.0).z();
+                    }
+                }
+            }
+            Geometry { paths: vec![fill(b.take())], text_rect: full.inset(-d), handles: vec![], sites: mid_sites(w, h) }
+        }
+        "callout1"
+        | "callout2"
+        | "callout3"
+        | "accentCallout1"
+        | "accentCallout2"
+        | "accentCallout3"
+        | "borderCallout2"
+        | "borderCallout3"
+        | "accentBorderCallout1"
+        | "accentBorderCallout2"
+        | "accentBorderCallout3" => {
+            let n = match name.chars().last() {
+                Some('2') => 2,
+                Some('3') => 3,
+                _ => 1,
+            };
+            line_callout(w, h, a, n + 1, name.starts_with("accent"), name.contains("order"))
+        }
+        "leftRightArrowCallout" | "upDownArrowCallout" => {
+            let vertical = name == "upDownArrowCallout";
+            let (l, t) = if vertical { (h, w) } else { (w, h) };
+            let ss = l.min(t);
+            let head = (ss * a(1).max(0.0) / 1e5).min(t / 2.0);
+            let shaft = (ss * a(0).max(0.0) / 1e5).min(head * 2.0);
+            let hl = (ss * a(2).max(0.0) / 1e5).min(l / 2.0);
+            let boxl = (l * a(3).max(0.0) / 1e5).min(l - 2.0 * hl);
+            let (c, b0, b1) = (t / 2.0, (l - boxl) / 2.0, (l + boxl) / 2.0);
+            let pts = [
+                (0.0, c),
+                (hl, c - head),
+                (hl, c - shaft / 2.0),
+                (b0, c - shaft / 2.0),
+                (b0, 0.0),
+                (b1, 0.0),
+                (b1, c - shaft / 2.0),
+                (l - hl, c - shaft / 2.0),
+                (l - hl, c - head),
+                (l, c),
+                (l - hl, c + head),
+                (l - hl, c + shaft / 2.0),
+                (b1, c + shaft / 2.0),
+                (b1, t),
+                (b0, t),
+                (b0, c + shaft / 2.0),
+                (hl, c + shaft / 2.0),
+                (hl, c + head),
+            ];
+            let d = if vertical { Dir::Down } else { Dir::Right };
+            let pts = orient(d, w, h, &pts);
+            let tr = orient(d, w, h, &[(b0, 0.0), (b1, t)]);
+            simple(b.poly(&pts).take(), Rect::from_points(Point::new(tr[0].0, tr[0].1), Point::new(tr[1].0, tr[1].1)).abs(), w, h)
+        }
+        "quadArrowCallout" => {
+            let head = (ss * a(1).max(0.0) / 1e5).min(ss / 2.0);
+            let shaft = (ss * a(0).max(0.0) / 1e5).min(head * 2.0);
+            let hl = (ss * a(2).max(0.0) / 1e5).min(ss / 2.0);
+            let k = a(3).clamp(0.0, 100000.0) / 1e5;
+            let (bw, bh) = ((w * k).min(w - 2.0 * hl).max(shaft), (h * k).min(h - 2.0 * hl).max(shaft));
+            let (cx, cy) = (w / 2.0, h / 2.0);
+            let (bx0, bx1, by0, by1) = (cx - bw / 2.0, cx + bw / 2.0, cy - bh / 2.0, cy + bh / 2.0);
+            let (s2, hd) = (shaft / 2.0, head);
+            let pts = [
+                (0.0, cy),
+                (hl, cy - hd),
+                (hl, cy - s2),
+                (bx0, cy - s2),
+                (bx0, by0),
+                (cx - s2, by0),
+                (cx - s2, hl),
+                (cx - hd, hl),
+                (cx, 0.0),
+                (cx + hd, hl),
+                (cx + s2, hl),
+                (cx + s2, by0),
+                (bx1, by0),
+                (bx1, cy - s2),
+                (w - hl, cy - s2),
+                (w - hl, cy - hd),
+                (w, cy),
+                (w - hl, cy + hd),
+                (w - hl, cy + s2),
+                (bx1, cy + s2),
+                (bx1, by1),
+                (cx + s2, by1),
+                (cx + s2, h - hl),
+                (cx + hd, h - hl),
+                (cx, h),
+                (cx - hd, h - hl),
+                (cx - s2, h - hl),
+                (cx - s2, by1),
+                (bx0, by1),
+                (bx0, cy + s2),
+                (hl, cy + s2),
+                (hl, cy + hd),
+            ];
+            simple(b.poly(&pts).take(), Rect::new(bx0, by0, bx1, by1), w, h)
+        }
+        "curvedRightArrow" | "curvedLeftArrow" | "curvedUpArrow" | "curvedDownArrow" => curved_arrow(name, w, h, a(0), a(1), a(2)),
+        "swooshArrow" => swoosh(w, h, a(0), a(1)),
+        "ellipseRibbon" | "ellipseRibbon2" => ellipse_ribbon(name == "ellipseRibbon2", w, h, a(0), a(1), a(2)),
+        "leftRightRibbon" => left_right_ribbon(w, h, a(0), a(1), a(2)),
+        "gear6" | "gear9" => gear(if name == "gear6" { 6 } else { 9 }, w, h, a(0), a(1)),
+        "funnel" => funnel(w, h),
+        "circularArrow" | "leftCircularArrow" | "leftRightCircularArrow" => circular_arrow(name, w, h, [a(0), a(1), a(2), a(3), a(4)]),
+        _ => return None,
+    };
+    Some(g)
+}
+
+/// An ellipse-centred frame for the circular arrows: the band's middle runs on the ellipse
+/// `(rx, ry)`, its edges `th/2` either side.
+struct Ring {
+    c: Point,
+    rx: f64,
+    ry: f64,
+    th: f64,
+    hw: f64,
+}
+
+impl Ring {
+    /// The point at visual angle `deg` on the ellipse grown by `d`.
+    fn at(&self, deg: f64, d: f64) -> Point {
+        let (ax, ay) = ((self.rx + d).max(0.0), (self.ry + d).max(0.0));
+        let t = vis(deg, ax, ay).to_radians();
+        Point::new(self.c.x + ax * t.cos(), self.c.y + ay * t.sin())
+    }
+    /// Parametric angle (degrees) of `p` on the ellipse grown by `d`.
+    fn param(&self, p: Point, d: f64) -> f64 {
+        let (ax, ay) = ((self.rx + d).max(1e-9), (self.ry + d).max(1e-9));
+        ((p.y - self.c.y) / ay).atan2((p.x - self.c.x) / ax).to_degrees()
+    }
+    /// Where the line `b + s·u` meets the ellipse grown by `d`, taking the crossing nearest `b`
+    /// on the side `sign` (+1 outwards, −1 inwards).
+    fn cross(&self, b: Point, u: Vec2, d: f64, sign: f64) -> Point {
+        let (ax, ay) = ((self.rx + d).max(1e-9), (self.ry + d).max(1e-9));
+        let (px, py) = ((b.x - self.c.x) / ax, (b.y - self.c.y) / ay);
+        let (ux, uy) = (u.x / ax, u.y / ay);
+        let qa = ux * ux + uy * uy;
+        let qb = 2.0 * (px * ux + py * uy);
+        let qc = px * px + py * py - 1.0;
+        let disc = qb * qb - 4.0 * qa * qc;
+        if qa < 1e-18 || disc < 0.0 {
+            // The line misses (a long head on a thin ring): the edge then carries on from the
+            // base centre itself, as the reference does.
+            return b;
+        }
+        let r = disc.sqrt();
+        let (s0, s1) = ((-qb - r) / (2.0 * qa), (-qb + r) / (2.0 * qa));
+        let s = if sign > 0.0 {
+            if s0 >= 0.0 { s0 } else { s1 }
+        } else if s1 <= 0.0 {
+            s1
+        } else {
+            s0
+        };
+        b + u * s
+    }
+    /// An arrow head whose base centre sits on the middle ellipse at `base` degrees and whose tip
+    /// sits there at `base + sweep`. The base runs along the line from the centre to the tip.
+    /// Returns (band outer edge, outer wing, tip, inner wing, band inner edge).
+    fn head(&self, base: f64, sweep: f64) -> [Point; 5] {
+        let b = self.at(base, 0.0);
+        let tip = self.at(base + sweep, 0.0);
+        let d = tip - self.c;
+        let u = if d.hypot() > 1e-12 { d / d.hypot() } else { Vec2::new(1.0, 0.0) };
+        let half = self.th / 2.0;
+        [self.cross(b, u, half, 1.0), b + u * self.hw, tip, b - u * self.hw, self.cross(b, u, -half, -1.0)]
+    }
+}
+
+/// Sweep (degrees) from `a` to `b` turning one way: positive when `dir > 0`.
+fn turn(a: f64, b: f64, dir: f64) -> f64 {
+    if dir > 0.0 { (b - a).rem_euclid(360.0) } else { -(a - b).rem_euclid(360.0) }
+}
+
+/// The circular arrows: a band along an ellipse with one head (`circularArrow` clockwise,
+/// `leftCircularArrow` anticlockwise) or a head at each end (`leftRightCircularArrow`).
+/// Adjusts: band thickness, head sweep (degrees), end angle, start angle, head half-width.
+fn circular_arrow(name: &str, w: f64, h: f64, a: [f64; 5]) -> Geometry {
+    let ss = w.min(h);
+    if ss <= 0.0 {
+        return simple(corner_rect(w, h, [Corner::Square; 4]), Rect::new(0.0, 0.0, w, h), w, h);
+    }
+    let a5 = a[4].clamp(0.0, 25000.0);
+    let hw = ss * a5 / 1e5;
+    let th = ss * a[0].clamp(0.0, 2.0 * a5) / 1e5;
+    let ring = Ring { c: Point::new(w / 2.0, h / 2.0), rx: (w / 2.0 - hw).max(th / 2.0), ry: (h / 2.0 - hw).max(th / 2.0), th, hw };
+    let deg = |v: f64| (v / 60000.0) % 360.0;
+    let (sweep, end, start) = (deg(a[1]), deg(a[2]), deg(a[3]));
+    let half = th / 2.0;
+    let mut b = Pb::new();
+    // Arcs of the ellipse grown by `d`, drawn on from the current point (which is on it except in
+    // the degenerate case above, where the arc shifts with it like the reference's).
+    let edge_arc = |b: &mut Pb, from: Point, to: Point, d: f64, dir: f64| {
+        let (ax, ay) = ((ring.rx + d).max(0.0), (ring.ry + d).max(0.0));
+        let (s, e) = (ring.param(from, d), ring.param(to, d));
+        b.arc(ax, ay, s, turn(s, e, dir));
+    };
+    let outer_arc = |b: &mut Pb, from: Point, to: Point, dir: f64| edge_arc(b, from, to, half, dir);
+    let inner_arc = |b: &mut Pb, from: Point, to: Point, dir: f64| edge_arc(b, from, to, -half, dir);
+    if name == "leftRightCircularArrow" {
+        let hs = ring.head(start, -sweep);
+        let he = ring.head(end, sweep);
+        b.m(hs[0].x, hs[0].y);
+        outer_arc(&mut b, hs[0], he[0], 1.0);
+        b.l(he[1].x, he[1].y).l(he[2].x, he[2].y).l(he[3].x, he[3].y).l(he[4].x, he[4].y);
+        inner_arc(&mut b, he[4], hs[4], -1.0);
+        b.l(hs[3].x, hs[3].y).l(hs[2].x, hs[2].y).l(hs[1].x, hs[1].y).z();
+    } else {
+        let dir = if name == "circularArrow" { 1.0 } else { -1.0 };
+        let he = ring.head(end, sweep);
+        let (o0, i0) = (ring.at(start, half), ring.at(start, -half));
+        b.m(o0.x, o0.y);
+        outer_arc(&mut b, o0, he[0], dir);
+        b.l(he[1].x, he[1].y).l(he[2].x, he[2].y).l(he[3].x, he[3].y).l(he[4].x, he[4].y);
+        inner_arc(&mut b, he[4], i0, -dir);
+        b.z();
+    }
+    simple(b.take(), Rect::new(0.0, 0.0, w, h), w, h)
+}
+
+/// A funnel: an elliptical rim (with an open mouth) across the top quarter, and straight sides
+/// down to a small rounded spout. The side lines leave the rim and meet the spout at fixed
+/// angles, fitted to the reference look.
+fn funnel(w: f64, h: f64) -> Geometry {
+    const RIM: f64 = 173.0; // where the left side leaves the rim, degrees on the rim ellipse
+    const SPOUT: f64 = 163.4; // where it meets the spout, degrees on the spout ellipse
+    let ss = w.min(h);
+    let (cx, rim_y) = (w / 2.0, h / 4.0);
+    let (sx, sy) = (w / 8.0, h / 15.0);
+    let spout_y = h - sy;
+    let at = |rx: f64, ry: f64, cy: f64, deg: f64| {
+        let t = deg.to_radians();
+        Point::new(cx + rx * t.cos(), cy + ry * t.sin())
+    };
+    let p0 = at(cx, rim_y, rim_y, RIM);
+    let p1 = at(sx, sy, spout_y, 180.0 - SPOUT);
+    let mut b = Pb::new();
+    b.m(p0.x, p0.y).arc(cx, rim_y, RIM, 540.0 - 2.0 * RIM);
+    b.l(p1.x, p1.y).arc(sx, sy, 180.0 - SPOUT, 2.0 * SPOUT - 180.0).z();
+    let d = ss / 20.0;
+    b.ellipse(cx, rim_y, (cx - d).max(0.0), (rim_y - d).max(0.0));
+    Geometry { paths: vec![fill_eo(b.take())], text_rect: Rect::new(w / 4.0, h / 2.0, w * 0.75, h - sy), handles: vec![], sites: mid_sites(w, h) }
+}
+
+/// A gear: an elliptical body with `n` teeth, the first pointing straight up. Each tooth leaves
+/// the body at two points an equal angle either side of its centre, and its tip corners sit a
+/// tooth height further out along the body's normal and a flank lean further in.
+fn gear(n: usize, w: f64, h: f64, a0: f64, a1: f64) -> Geometry {
+    let ss = w.min(h);
+    let th = ss * a0.clamp(0.0, 20000.0) / 1e5; // tooth height
+    let lean_max = if n == 6 { 5380.0 } else { 2730.0 };
+    let l = ss * a1.clamp(0.0, a0.clamp(0.0, 20000.0).min(lean_max)) / 1e5; // flank lean
+    let (cx, cy) = (w / 2.0, h / 2.0);
+    let (rx, ry) = ((cx - th).max(0.0), (cy - th).max(0.0));
+    let r = (ss / 2.0 - th).max(1e-9);
+    let half = ((th + l) / 2.0 / r).atan();
+    let step = std::f64::consts::TAU / n as f64;
+    let on_body = |t: f64| Point::new(cx + rx * t.cos(), cy + ry * t.sin());
+    let mut b = Pb::new();
+    for k in 0..n {
+        let t = -std::f64::consts::FRAC_PI_2 + step * k as f64;
+        // The tooth stands along the body's normal at its centre.
+        let nrm = Vec2::new(t.cos() * ry, t.sin() * rx);
+        let u = if nrm.hypot() > 1e-12 { nrm / nrm.hypot() } else { Vec2::new(t.cos(), t.sin()) };
+        let v = Vec2::new(-u.y, u.x);
+        let (r0, r1) = (on_body(t - half), on_body(t + half));
+        let (c0, c1) = (r0 + u * th + v * l, r1 + u * th - v * l);
+        if k == 0 {
+            b.m(r0.x, r0.y);
+        } else {
+            b.arc(rx, ry, (t - step + half).to_degrees(), (step - 2.0 * half).to_degrees());
+        }
+        b.l(c0.x, c0.y).l(c1.x, c1.y).l(r1.x, r1.y);
+    }
+    let t_last = -std::f64::consts::FRAC_PI_2 + step * (n - 1) as f64;
+    b.arc(rx, ry, (t_last + half).to_degrees(), (step - 2.0 * half).to_degrees()).z();
+    let k = std::f64::consts::FRAC_1_SQRT_2;
+    let text = Rect::new(cx - rx * k, cy - ry * k, cx + rx * k, cy + ry * k);
+    simple(b.take(), text, w, h)
+}
+
+/// Two arrows on a band that steps down in the middle: the left arrow sits high, the right one low,
+/// and the band rolls over between them in a shaded half-ellipse curl.
+fn left_right_ribbon(w: f64, h: f64, a0: f64, a1: f64, a2: f64) -> Geometry {
+    let ss = w.min(h);
+    let sh = h * a2.clamp(0.0, 33333.0) / 1e5; // step between the two halves
+    let bt = (h * a0.max(0.0) / 1e5).min(h - sh); // band thickness
+    let cx = w / 2.0;
+    let (rx, ry) = (w / 32.0, (sh / 4.0).min(w / 24.0));
+    let hb = (ss * a1.max(0.0) / 1e5).min(cx - rx); // head length
+    let yc = (h - sh) / 2.0;
+    let (lt, lb) = (yc - bt / 2.0, yc + bt / 2.0);
+    let (rt, rb) = (lt + sh, lb + sh);
+    // The left half: filled as a closed outline, stroked only where it can show.
+    let mut edge = Pb::new();
+    edge.m(cx - rx, lb).l(hb, lb).l(hb, h - sh).l(0.0, yc).l(hb, 0.0).l(hb, lt).l(cx, lt);
+    edge.arc(rx, ry, 270.0, 180.0).arc(rx, ry, 270.0, -90.0);
+    let edge = edge.take();
+    let mut left = Pb::new();
+    left.m(0.0, yc).l(hb, 0.0).l(hb, lt).l(cx, lt).arc(rx, ry, 270.0, 180.0).arc(rx, ry, 270.0, -180.0);
+    left.l(cx, lb.max(lt + 4.0 * ry)).l(hb, lb).l(hb, h - sh).z();
+    let left = left.take();
+    let mut curl = Pb::new();
+    curl.m(cx + rx, lt + ry).l(cx + rx, rt).l(cx, lt + 4.0 * ry).arc(rx, ry, 90.0, 180.0).arc(rx, ry, 90.0, -90.0).z();
+    let mut right = Pb::new();
+    right.m(w, yc + sh).l(w - hb, h).l(w - hb, rb).l(cx, rb).arc(rx, ry, 90.0, 90.0).l(cx - rx, rt - ry).arc(rx, ry, 180.0, -90.0);
+    right.l(w - hb, rt).l(w - hb, sh).z();
+    Geometry {
+        paths: vec![fill_only(left), stroke_only(edge), shade(curl.take(), FillMode::DarkenLess), fill(right.take())],
+        text_rect: Rect::new(hb.min(cx - rx), rt, (w - hb).max(cx + rx), lb.max(rt)),
+        handles: vec![],
+        sites: vec![Point::new(0.0, yc), Point::new(cx, rt), Point::new(w, yc + sh), Point::new(cx, lb)],
+    }
+}
+
+/// Adds a piece of the parabola `y = y0 + d·(1 − ((x − w/2)/(w/2))²)` from the current point (at
+/// `xa`) to `xb`, as one quadratic curve.
+fn sag(b: &mut Pb, w: f64, d: f64, y0: f64, xa: f64, xb: f64) {
+    let hw = (w / 2.0).max(1e-9);
+    let f = |x: f64| y0 + d * (1.0 - ((x - hw) / hw).powi(2));
+    let slope = -2.0 * d * (xa - hw) / (hw * hw);
+    b.q((xa + xb) / 2.0, f(xa) + slope * (xb - xa) / 2.0, xb, f(xb));
+}
+
+/// A ribbon whose edges sag along one parabola: a front band in the middle and two notched ends
+/// behind it, joined by shaded folds. Built sagging downwards; `up` mirrors it vertically.
+fn ellipse_ribbon(up: bool, w: f64, h: f64, a0: f64, a1: f64, a2: f64) -> Geometry {
+    let th = h * a0.clamp(0.0, 100000.0) / 1e5; // band drop at the centre
+    // Sag of every edge: never more than the drop, never so little that the band would rise
+    // above the ends by more than half their height.
+    let d = (h * a2.max(0.0) / 1e5).max(th - (h - th) / 2.0).clamp(0.0, th);
+    let bw = w * a1.clamp(25000.0, 75000.0) / 1e5;
+    let (x0, x1) = ((w - bw) / 2.0, (w + bw) / 2.0);
+    let ear = w / 8.0;
+    let (xf, xg) = (x0 + ear, x1 - ear);
+    let e = h - th; // band height
+    let off = th - d; // band top below the ends' top
+    let t = |x: f64| {
+        let hw = (w / 2.0).max(1e-9);
+        d * (1.0 - ((x - hw) / hw).powi(2))
+    };
+    let mut ends = Pb::new();
+    ends.m(0.0, 0.0);
+    sag(&mut ends, w, d, 0.0, 0.0, xf);
+    ends.l(xf, t(xf) + off).l(x0, t(x0) + off).l(x0, t(x0) + e);
+    sag(&mut ends, w, d, e, x0, 0.0);
+    ends.l(ear, t(ear) + e / 2.0).z();
+    ends.m(w, 0.0).l(w - ear, t(w - ear) + e / 2.0).l(w, e);
+    sag(&mut ends, w, d, e, w, x1);
+    ends.l(x1, t(x1) + off).l(xg, t(xg) + off).l(xg, t(xg));
+    sag(&mut ends, w, d, 0.0, xg, w);
+    ends.z();
+    let mut folds = Pb::new();
+    folds.poly(&[(x0, t(x0) + off), (xf, t(xf)), (xf, t(xf) + off)]);
+    folds.poly(&[(x1, t(x1) + off), (xg, t(xg)), (xg, t(xg) + off)]);
+    let mut band = Pb::new();
+    band.m(x0, t(x0) + off);
+    sag(&mut band, w, d, off, x0, x1);
+    band.l(x1, t(x1) + off + e);
+    sag(&mut band, w, d, off + e, x1, x0);
+    band.z();
+    let mut paths = vec![fill(ends.take()), shade(folds.take(), FillMode::DarkenLess), fill(band.take())];
+    let mut text = Rect::new(x0, th, x1, t(x0) + off + e);
+    if up {
+        let m = kurbo::Affine::new([1.0, 0.0, 0.0, -1.0, 0.0, h]);
+        for p in &mut paths {
+            p.path.apply_affine(m);
+        }
+        text = m.transform_rect_bbox(text);
+    }
+    Geometry { paths, text_rect: text, handles: vec![], sites: mid_sites(w, h) }
+}
+
+/// A sweeping arrow rising from the bottom-left corner. The band's two edges are quadratic curves
+/// from the corner; the head's base leans slightly forward and reaches one eighth of the shorter
+/// side above and below the band. The tilt and the tip's lift were fitted to the reference look.
+fn swoosh(w: f64, h: f64, a0: f64, a1: f64) -> Geometry {
+    const TILT: f64 = 0.1126; // tan of the head base's lean from vertical
+    const LIFT: f64 = 0.051; // tip height above the band's centre, per unit of height
+    let ss = w.min(h);
+    let e = ss / 8.0;
+    let th = (h * a0.max(0.0) / 1e5).min((h - 2.0 * e).max(0.0));
+    // The head is at least long enough to keep its leaning base inside the frame.
+    let hl = (ss * a1.max(0.0) / 1e5).max((e + th) * TILT).min((w - e * TILT).max(0.0));
+    let qx = w - hl;
+    let mut b = Pb::new();
+    b.m(0.0, h)
+        .q(w / 6.0, h / 3.0, qx, e)
+        .l(qx - e * TILT, 0.0)
+        .l(w, (e + th / 2.0 - LIFT * h).clamp(0.0, 2.0 * e + th))
+        .l((qx + (e + th) * TILT).min(w), 2.0 * e + th)
+        .l((qx + th * TILT).min(w), e + th)
+        .q(w / 4.0, (th + h / 12.0 + e).min(h), 0.0, h)
+        .z();
+    simple(b.take(), Rect::new(0.0, 0.0, w, h), w, h)
+}
+
+/// A band that sweeps around half an ellipse and ends in an arrow head. Built pointing right
+/// (`curvedRightArrow`) in a `cw`×`ch` frame, then turned for the other directions.
+///
+/// Both halves of the band hang off one ellipse touching the far side: its centre sits on the
+/// head side's edge, its horizontal radius is the full length, and the band has a constant
+/// vertical thickness. The back half (shaded) starts flat against the head side; the front half
+/// runs to the head, centred on the band where it ends.
+fn curved_arrow(name: &str, w: f64, h: f64, a0: f64, a1: f64, a2: f64) -> Geometry {
+    let along_x = matches!(name, "curvedRightArrow" | "curvedLeftArrow");
+    let (cw, ch) = if along_x { (w, h) } else { (h, w) };
+    let ss = cw.min(ch);
+    let head = (ss * a1.max(0.0) / 1e5).min(ch / 2.0);
+    let th = (ss * a0.max(0.0) / 1e5).min(head);
+    let hl = (ss * a2.max(0.0) / 1e5).min(cw);
+    let hh = head / 2.0;
+    // The band's centre line, carried on to the head side, ends at the tip, which sits half a
+    // head width above the bottom.
+    let r = ((ch - hh - th / 2.0) / 2.0).max(0.0);
+    // Parametric angle where the front band reaches the head base.
+    let te = if cw > 0.0 { (-(hl / cw)).clamp(-1.0, 1.0).acos().to_degrees() } else { 90.0 };
+    let mut back = Pb::new();
+    back.m(cw, 0.0).arc(cw, r, 270.0, -90.0).l(0.0, r + th).arc(cw, r, 180.0, 90.0).z();
+    let mut front = Pb::new();
+    front.m(0.0, r).arc(cw, r, 180.0, te - 180.0);
+    let yb = front.cur.y;
+    let yc = yb + th / 2.0;
+    front.l(cw - hl, yc - hh).l(cw, 2.0 * r + th / 2.0).l(cw - hl, yc + hh).l(cw - hl, yb + th).arc(cw, r, te, 180.0 - te).z();
+    let m = match name {
+        "curvedLeftArrow" => kurbo::Affine::new([-1.0, 0.0, 0.0, 1.0, w, 0.0]),
+        "curvedUpArrow" => kurbo::Affine::new([0.0, -1.0, 1.0, 0.0, 0.0, h]),
+        "curvedDownArrow" => kurbo::Affine::new([0.0, 1.0, 1.0, 0.0, 0.0, 0.0]),
+        _ => kurbo::Affine::IDENTITY,
+    };
+    let (mut back, mut front) = (back.take(), front.take());
+    back.apply_affine(m);
+    front.apply_affine(m);
+    Geometry {
+        paths: vec![shade(back, FillMode::DarkenLess), fill(front)],
+        text_rect: Rect::new(0.0, 0.0, w, h),
+        handles: vec![],
+        sites: mid_sites(w, h),
+    }
+}
+
+/// A rectangle with a callout leader through `pts` points (`(y, x)` adjust pairs in 1/100 000 of
+/// the height and width), optionally with an accent bar at the first point's x and a border.
+fn line_callout(w: f64, h: f64, a: &dyn Fn(usize) -> f64, pts: usize, accent: bool, border: bool) -> Geometry {
+    let body = corner_rect(w, h, [Corner::Square; 4]);
+    // Leaders may reach well outside the box, but not without bound.
+    let pt = |i: usize| (w * a(2 * i + 1).clamp(-1e7, 1e7) / 1e5, h * a(2 * i).clamp(-1e7, 1e7) / 1e5);
+    let mut l = Pb::new();
+    let (x0, y0) = pt(0);
+    l.m(x0, y0);
+    for i in 1..pts {
+        let (x, y) = pt(i);
+        l.l(x, y);
+    }
+    let mut paths = vec![if border { fill(body) } else { fill_only(body) }];
+    if accent {
+        paths.push(stroke_only(Pb::new().m(x0, 0.0).l(x0, h).take()));
+    }
+    paths.push(stroke_only(l.take()));
+    Geometry { paths, text_rect: Rect::new(0.0, 0.0, w, h), handles: vec![], sites: mid_sites(w, h) }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{CATALOG, FillMode, build, info};
+    use kurbo::{BezPath, PathEl, Point, Shape};
+
+    const NEW: [&str; 38] = [
+        "lineInv",
+        "nonIsoscelesTrapezoid",
+        "pieWedge",
+        "leftRightArrowCallout",
+        "upDownArrowCallout",
+        "quadArrowCallout",
+        "circularArrow",
+        "leftCircularArrow",
+        "leftRightCircularArrow",
+        "curvedRightArrow",
+        "curvedLeftArrow",
+        "curvedUpArrow",
+        "curvedDownArrow",
+        "swooshArrow",
+        "callout1",
+        "callout2",
+        "callout3",
+        "accentCallout1",
+        "accentCallout2",
+        "accentCallout3",
+        "borderCallout2",
+        "borderCallout3",
+        "accentBorderCallout1",
+        "accentBorderCallout2",
+        "accentBorderCallout3",
+        "ellipseRibbon",
+        "ellipseRibbon2",
+        "leftRightRibbon",
+        "flowChartOfflineStorage",
+        "gear6",
+        "gear9",
+        "funnel",
+        "cornerTabs",
+        "squareTabs",
+        "plaqueTabs",
+        "chartX",
+        "chartStar",
+        "chartPlus",
+    ];
+
+    fn outline(name: &str, w: f64, h: f64, adj: &[f64]) -> BezPath {
+        build(name, w, h, adj).map(|g| g.outline()).unwrap_or_default()
+    }
+
+    /// Distance from `p` to the nearest point of the (flattened) outline.
+    fn dist(path: &BezPath, p: Point) -> f64 {
+        let mut best = f64::MAX;
+        let mut prev = Point::ZERO;
+        let mut start = Point::ZERO;
+        kurbo::flatten(path.iter(), 0.01, |el| {
+            let (a, b) = match el {
+                PathEl::MoveTo(q) => {
+                    prev = q;
+                    start = q;
+                    return;
+                }
+                PathEl::LineTo(q) => (prev, q),
+                PathEl::ClosePath => (prev, start),
+                _ => return,
+            };
+            let d = b - a;
+            let t = if d.hypot2() > 0.0 { ((p - a).dot(d) / d.hypot2()).clamp(0.0, 1.0) } else { 0.0 };
+            best = best.min((a + d * t - p).hypot());
+            prev = b;
+        });
+        best
+    }
+
+    /// Asserts every point lies within 1pt of the outline.
+    fn on(name: &str, w: f64, h: f64, adj: &[f64], pts: &[(f64, f64)]) {
+        let path = outline(name, w, h, adj);
+        for &(x, y) in pts {
+            let d = dist(&path, Point::new(x, y));
+            assert!(d < 1.0, "{name} {w}x{h} {adj:?}: ({x}, {y}) is {d:.2} from the outline");
+        }
+    }
+
+    #[test]
+    fn new_presets_are_in_the_catalog() {
+        for n in NEW {
+            let i = info(n).unwrap_or_else(|| panic!("{n} missing from the catalog"));
+            assert!(!i.label.is_empty());
+        }
+        assert!(CATALOG.len() >= 183);
+    }
+
+    #[test]
+    fn new_presets_build_within_bounds_at_many_sizes_and_adjusts() {
+        let sizes = [(480.0, 300.0), (300.0, 300.0), (200.0, 460.0), (100.0, 460.0), (1.0, 1.0), (0.0, 0.0), (0.0, 50.0), (60.0, 0.0)];
+        let adjusts: [&[f64]; 8] = [
+            &[],
+            &[0.0; 8],
+            &[100000.0; 8],
+            &[-50000.0; 8],
+            &[1e12, -1e12, 1e12, -1e12, 1e12, -1e12, 1e12, -1e12],
+            &[f64::MAX, f64::MIN, f64::MAX, f64::MIN, f64::MAX, f64::MIN, f64::MAX, f64::MIN],
+            &[f64::NAN, f64::INFINITY, f64::NEG_INFINITY, f64::NAN, 5.0, 6.0, 7.0, 8.0],
+            &[30000.0, 60000.0, 20000.0, 9000000.0, 20000.0, 40000.0, 120000.0, -30000.0],
+        ];
+        for n in NEW {
+            // Line callouts' leaders may reach anywhere, by design.
+            let callout = n.contains("allout") && !n.contains("Arrow");
+            for (w, h) in sizes {
+                for adj in adjusts {
+                    let g = build(n, w, h, adj).unwrap_or_else(|| panic!("{n} did not build"));
+                    assert!(!g.paths.is_empty(), "{n} has no paths");
+                    for s in &g.paths {
+                        let bb = s.path.bounding_box();
+                        assert!(bb.x0.is_finite() && bb.y0.is_finite() && bb.x1.is_finite() && bb.y1.is_finite(), "{n} {w}x{h} {adj:?}: {bb:?}");
+                        if !callout {
+                            // Circular arrows with a head longer than their ring can hold carry the
+                            // inner edge on from the head, as the reference does, so may spill.
+                            let spill = if n.contains("ircular") { 0.5 } else { 0.01 };
+                            let tol = 0.5 + w.max(h) * spill;
+                            assert!(
+                                bb.x0 >= -tol && bb.y0 >= -tol && bb.x1 <= w + tol && bb.y1 <= h + tol,
+                                "{n} {w}x{h} {adj:?} out of bounds: {bb:?}"
+                            );
+                        }
+                    }
+                    let t = g.text_rect;
+                    assert!(t.x0.is_finite() && t.y0.is_finite() && t.x1.is_finite() && t.y1.is_finite(), "{n} text rect {t:?}");
+                }
+            }
+            let g = build(n, 480.0, 300.0, &[]).unwrap_or_else(|| panic!("{n}"));
+            assert!(g.outline().elements().len() >= 2, "{n} default outline is empty");
+        }
+    }
+
+    // The spot checks below are outline points measured on reference renders.
+
+    #[test]
+    fn simple_new_presets_match_reference_points() {
+        on("lineInv", 480.0, 300.0, &[], &[(0.0, 300.0), (480.0, 0.0)]);
+        on("nonIsoscelesTrapezoid", 480.0, 300.0, &[], &[(75.0, 0.0), (405.0, 0.0), (0.0, 300.0)]);
+        on("nonIsoscelesTrapezoid", 200.0, 460.0, &[80000.0, 20000.0], &[(100.0, 0.0), (160.0, 0.0)]);
+        on("pieWedge", 480.0, 300.0, &[], &[(64.3, 150.0), (0.0, 300.0), (480.0, 0.0)]);
+        on("flowChartOfflineStorage", 480.0, 300.0, &[], &[(240.0, 300.0), (192.0, 240.0), (288.0, 240.0)]);
+        on("squareTabs", 480.0, 300.0, &[], &[(28.3, 28.3), (451.7, 271.7)]);
+        on("cornerTabs", 480.0, 300.0, &[], &[(23.3, 5.0)]);
+        on("plaqueTabs", 480.0, 300.0, &[], &[(27.85, 5.0)]);
+        on("chartStar", 480.0, 300.0, &[], &[(240.0, 0.0), (240.0, 300.0), (48.0, 30.0)]);
+        on("chartPlus", 480.0, 300.0, &[], &[(0.0, 150.0), (240.0, 0.0)]);
+        // Chart markers and plain callouts leave the box unstroked.
+        for n in ["chartX", "callout1", "accentCallout2"] {
+            let g = build(n, 100.0, 100.0, &[]).unwrap_or_else(|| panic!("{n}"));
+            assert!(!g.paths[0].stroke, "{n}");
+        }
+    }
+
+    #[test]
+    fn line_callouts_follow_their_adjusts() {
+        on("callout3", 480.0, 300.0, &[], &[(-40.0, 56.25), (-80.0, 56.25), (-80.0, 300.0), (-40.0, 338.9)]);
+        let adj = [50000.0, 110000.0, 20000.0, 120000.0, -20000.0, 80000.0, 30000.0, 40000.0];
+        let g = build("accentBorderCallout3", 480.0, 300.0, &adj).unwrap_or_else(|| panic!("accentBorderCallout3"));
+        assert_eq!(g.paths.len(), 3);
+        assert!(g.paths[0].stroke);
+        let accent = g.paths[1].path.bounding_box();
+        assert!((accent.x0 - 528.0).abs() < 1e-6 && accent.y0 == 0.0 && accent.y1 == 300.0, "{accent:?}");
+        on("accentBorderCallout3", 480.0, 300.0, &adj, &[(576.0, 60.0), (384.0, -60.0), (192.0, 90.0)]);
+    }
+
+    #[test]
+    fn arrow_callouts_match_reference_points() {
+        on("leftRightArrowCallout", 480.0, 300.0, &[], &[(0.0, 150.0), (75.0, 75.0), (124.5, 0.0), (355.5, 300.0), (480.0, 150.0)]);
+        on("leftRightArrowCallout", 200.0, 460.0, &[], &[(50.0, 180.0), (52.0, 0.0), (148.0, 460.0)]);
+        on("upDownArrowCallout", 480.0, 300.0, &[], &[(240.0, 0.0), (0.0, 77.8), (480.0, 222.2), (240.0, 300.0)]);
+        on("quadArrowCallout", 480.0, 300.0, &[], &[(0.0, 150.0), (124.5, 77.8), (240.0, 0.0), (480.0, 150.0), (240.0, 300.0)]);
+    }
+
+    #[test]
+    fn curved_arrows_match_reference_points() {
+        on(
+            "curvedRightArrow",
+            480.0,
+            300.0,
+            &[],
+            &[(480.0, 0.0), (480.0, 75.0), (480.0, 225.0), (405.0, 149.0), (405.0, 299.0), (100.0, 151.5), (300.0, 6.7)],
+        );
+        on("curvedRightArrow", 200.0, 460.0, &[30000.0, 60000.0, 40000.0], &[(200.0, 400.0), (120.0, 324.5), (120.0, 443.5), (200.0, 60.0)]);
+        // The band never outgrows the head; the head never outgrows half the frame.
+        on("curvedRightArrow", 200.0, 460.0, &[60000.0, 30000.0, 80000.0], &[(200.0, 60.0)]);
+        on("curvedLeftArrow", 480.0, 300.0, &[], &[(0.0, 225.0), (0.0, 0.0)]);
+        on("curvedUpArrow", 480.0, 300.0, &[], &[(405.0, 0.0), (0.0, 0.0), (75.0, 0.0)]);
+        on("curvedDownArrow", 480.0, 300.0, &[], &[(405.0, 300.0), (0.0, 300.0)]);
+        let g = build("curvedRightArrow", 480.0, 300.0, &[]).unwrap_or_else(|| panic!("curvedRightArrow"));
+        assert_eq!(g.paths[0].fill, FillMode::DarkenLess);
+    }
+
+    #[test]
+    fn swoosh_matches_reference_points() {
+        on("swooshArrow", 480.0, 300.0, &[], &[(0.0, 300.0), (425.8, 0.0), (480.0, 59.7), (442.8, 150.0), (202.0, 105.5), (202.0, 159.0)]);
+        on("swooshArrow", 480.0, 300.0, &[40000.0, 16667.0], &[(480.0, 82.2), (447.8, 195.0)]);
+        on("swooshArrow", 200.0, 460.0, &[], &[(163.9, 0.0), (200.0, 59.4)]);
+    }
+
+    #[test]
+    fn ribbons_match_reference_points() {
+        on(
+            "ellipseRibbon",
+            480.0,
+            300.0,
+            &[],
+            &[(0.0, 0.0), (120.0, 28.1), (60.0, 128.9), (240.0, 300.0), (120.0, 66.1), (180.0, 72.2), (180.0, 35.2)],
+        );
+        on("ellipseRibbon", 480.0, 300.0, &[30000.0, 60000.0, 20000.0], &[(120.0, 45.0), (240.0, 300.0), (96.0, 68.4)]);
+        on("ellipseRibbon", 480.0, 300.0, &[80000.0, 20000.0, 60000.0], &[(240.0, 240.0), (1.0, 61.75)]);
+        on("ellipseRibbon2", 480.0, 300.0, &[], &[(0.0, 300.0), (240.0, 0.0)]);
+        on(
+            "leftRightRibbon",
+            480.0,
+            300.0,
+            &[],
+            &[(0.0, 125.0), (150.0, 0.0), (150.0, 50.0), (255.0, 62.5), (225.0, 87.5), (480.0, 175.0), (330.0, 300.0)],
+        );
+        on("leftRightRibbon", 480.0, 300.0, &[90000.0, 10000.0, 60000.0], &[(0.0, 100.0), (480.0, 200.0), (240.0, 300.0)]);
+    }
+
+    #[test]
+    fn gears_and_funnel_match_reference_points() {
+        // Square gear6: body radius 105, top tooth tip 3.5 inside the frame, tip half-width ~16.3.
+        on("gear6", 300.0, 300.0, &[], &[(150.0, 3.5), (133.7, 3.5), (166.3, 3.5), (45.0, 150.0)]);
+        on("gear9", 300.0, 300.0, &[], &[(150.0, 1.0), (30.0, 150.0)]);
+        on("gear6", 480.0, 300.0, &[], &[(240.0, 3.5), (201.0, 3.5)]);
+        on("funnel", 480.0, 300.0, &[], &[(240.0, 0.0), (0.0, 75.0), (240.0, 15.0), (15.0, 75.0), (240.0, 300.0), (60.5, 150.0)]);
+        let g = build("funnel", 480.0, 300.0, &[]).unwrap_or_else(|| panic!("funnel"));
+        assert!(g.paths[0].even_odd);
+    }
+
+    #[test]
+    fn circular_arrows_match_reference_points() {
+        on("circularArrow", 300.0, 300.0, &[], &[(19.0, 150.0), (56.5, 150.0), (150.0, 19.0), (262.4, 150.0), (218.6, 113.4), (293.6, 113.4)]);
+        on(
+            "circularArrow",
+            300.0,
+            300.0,
+            &[20000.0, 1800000.0, 18000000.0, 5400000.0, 20000.0],
+            &[(150.0, 270.0), (150.0, 210.0), (247.0, 42.1), (143.0, 102.1), (227.9, 105.0)],
+        );
+        on("leftCircularArrow", 300.0, 300.0, &[], &[(37.6, 150.0), (262.4, 150.0), (150.0, 281.0)]);
+        on("leftRightCircularArrow", 300.0, 300.0, &[], &[(262.4, 150.0), (37.6, 150.0), (150.0, 19.0)]);
+        // The band never grows past twice the head's half-width.
+        on("circularArrow", 300.0, 300.0, &[25000.0, 1142319.0, 20457681.0, 10800000.0, 5000.0], &[(0.0, 150.0), (30.0, 150.0)]);
+    }
+}

crates/metafile/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "deckcraft-metafile"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "DeckCraft metafiles (ported from WordCraft): parses Windows WMF and EMF records into a neutral vector model (paths and bitmaps)"
+
+[lints]
+workspace = true
+
+[dependencies]
+kurbo = { workspace = true }
+thiserror = { workspace = true }

crates/metafile/src/bytes.rs

@@ -0,0 +1,59 @@
+//! Bounds-checked little-endian access to hostile input. Every read returns `None` past the end, so
+//! a truncated or lying size field stops the parse instead of panicking.
+
+#[derive(Clone, Copy)]
+pub(crate) struct Bytes<'a>(pub(crate) &'a [u8]);
+
+impl<'a> Bytes<'a> {
+    pub fn slice(&self, off: usize, len: usize) -> Option<&'a [u8]> {
+        self.0.get(off..off.checked_add(len)?)
+    }
+
+    pub fn tail(&self, off: usize) -> Option<Bytes<'a>> {
+        self.0.get(off..).map(Bytes)
+    }
+
+    fn arr<const N: usize>(&self, off: usize) -> Option<[u8; N]> {
+        self.slice(off, N)?.try_into().ok()
+    }
+
+    pub fn u16(&self, off: usize) -> Option<u16> {
+        Some(u16::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn i16(&self, off: usize) -> Option<i16> {
+        Some(i16::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn u32(&self, off: usize) -> Option<u32> {
+        Some(u32::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn i32(&self, off: usize) -> Option<i32> {
+        Some(i32::from_le_bytes(self.arr(off)?))
+    }
+
+    pub fn f32(&self, off: usize) -> Option<f32> {
+        Some(f32::from_le_bytes(self.arr(off)?))
+    }
+
+    /// `n` consecutive (x, y) pairs of 16- or 32-bit signed integers starting at `off`.
+    pub fn points(&self, off: usize, n: usize, wide: bool) -> Option<Vec<(f64, f64)>> {
+        let sz = if wide { 8 } else { 4 };
+        let raw = self.slice(off, n.checked_mul(sz)?)?;
+        let mut out = Vec::with_capacity(n);
+        for c in raw.chunks_exact(sz) {
+            let p = if wide {
+                let x = i32::from_le_bytes(c.get(0..4)?.try_into().ok()?);
+                let y = i32::from_le_bytes(c.get(4..8)?.try_into().ok()?);
+                (f64::from(x), f64::from(y))
+            } else {
+                let x = i16::from_le_bytes(c.get(0..2)?.try_into().ok()?);
+                let y = i16::from_le_bytes(c.get(2..4)?.try_into().ok()?);
+                (f64::from(x), f64::from(y))
+            };
+            out.push(p);
+        }
+        Some(out)
+    }
+}

crates/metafile/src/canvas.rs

@@ -0,0 +1,574 @@
+//! Drawing state shared by the WMF and EMF readers: window/viewport mapping and the EMF world
+//! transform, pen and brush selection through an object table, the DC save stack and path brackets.
+//! Output is device-space items; `lib.rs` maps them into the picture frame.
+
+use crate::dib::Rgba;
+use crate::geom::{Op, P};
+use crate::{MAX_BYTES, MAX_ITEMS, MAX_OBJECTS, MAX_PATH_OPS, MAX_STACK};
+
+pub(crate) const MM_TEXT: u32 = 1;
+const MM_ISOTROPIC: u32 = 7;
+const MM_ANISOTROPIC: u32 = 8;
+const STOCK: u32 = 0x8000_0000;
+pub(crate) const PS_NULL: u32 = 5;
+/// Pen style bits; the rest of the style word holds end-cap, join and type flags.
+pub(crate) const PS_STYLE_MASK: u32 = 0x0F;
+const BS_SOLID: u32 = 0;
+pub(crate) const BS_NULL: u32 = 1;
+const WINDING: u32 = 2;
+/// SETROP2 mix mode that leaves the destination alone: outlines and fills draw nothing.
+const R2_NOP: u32 = 11;
+const PATCOPY: u32 = 0x00F0_0021;
+const BLACKNESS: u32 = 0x0000_0042;
+const WHITENESS: u32 = 0x00FF_0062;
+/// Device pixels per millimetre assumed for WMF (96 dpi), and for EMF files without a device size.
+const DEFAULT_PX_PER_MM: f64 = 96.0 / 25.4;
+
+/// Affine transform `[m11, m12, m21, m22, dx, dy]` in EMF XFORM order: `x' = x·m11 + y·m21 + dx`.
+pub(crate) type Xform = [f64; 6];
+const IDENTITY: Xform = [1.0, 0.0, 0.0, 1.0, 0.0, 0.0];
+
+/// `a` then `b` in EMF row-vector convention: the matrix product `a × b`.
+pub(crate) fn mul(a: Xform, b: Xform) -> Xform {
+    [
+        a[0] * b[0] + a[1] * b[2],
+        a[0] * b[1] + a[1] * b[3],
+        a[2] * b[0] + a[3] * b[2],
+        a[2] * b[1] + a[3] * b[3],
+        a[4] * b[0] + a[5] * b[2] + b[4],
+        a[4] * b[1] + a[5] * b[3] + b[5],
+    ]
+}
+
+#[derive(Clone, Copy, PartialEq, Debug)]
+pub(crate) struct Pen {
+    pub style: u32,
+    /// Logical width; 0 means a cosmetic one-pixel hairline.
+    pub width: f64,
+    pub color: [u8; 4],
+}
+
+#[derive(Clone, Copy, PartialEq, Debug)]
+pub(crate) struct Brush {
+    pub style: u32,
+    pub color: [u8; 4],
+}
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) enum Obj {
+    Pen(Pen),
+    Brush(Brush),
+    /// Fonts, palettes, pattern brushes and regions: they take a table slot but draw nothing.
+    Other,
+}
+
+/// Converts a COLORREF (0x00BBGGRR) to opaque RGBA.
+pub(crate) fn colorref(c: u32) -> [u8; 4] {
+    [(c & 0xFF) as u8, ((c >> 8) & 0xFF) as u8, ((c >> 16) & 0xFF) as u8, 255]
+}
+
+/// Millimetres per logical unit of the metric map modes (LOMETRIC, HIMETRIC, LOENGLISH, HIENGLISH, TWIPS).
+fn metric_mm(mode: u32) -> Option<f64> {
+    match mode {
+        2 => Some(0.1),
+        3 => Some(0.01),
+        4 => Some(25.4 / 100.0),
+        5 => Some(25.4 / 1000.0),
+        6 => Some(25.4 / 1440.0),
+        _ => None,
+    }
+}
+
+#[derive(Clone, Copy)]
+pub(crate) struct Mapping {
+    wo: P,
+    we: P,
+    vo: P,
+    ve: P,
+    mode: u32,
+    world: Xform,
+    /// Device pixels per millimetre on each axis (EMF: from szlDevice and szlMillimeters).
+    px_mm: P,
+}
+
+impl Mapping {
+    fn identity() -> Self {
+        Mapping {
+            wo: (0.0, 0.0),
+            we: (1.0, 1.0),
+            vo: (0.0, 0.0),
+            ve: (1.0, 1.0),
+            mode: MM_TEXT,
+            world: IDENTITY,
+            px_mm: (DEFAULT_PX_PER_MM, DEFAULT_PX_PER_MM),
+        }
+    }
+
+    /// Logical point to device point: world transform, then window to viewport.
+    pub fn device(&self, p: P) -> P {
+        let w = self.world;
+        let (x, y) = (p.0 * w[0] + p.1 * w[2] + w[4], p.0 * w[1] + p.1 * w[3] + w[5]);
+        let (sx, sy) = self.ratios();
+        ((x - self.wo.0) * sx + self.vo.0, (y - self.wo.1) * sy + self.vo.1)
+    }
+
+    /// Window-to-viewport scale per axis. MM_TEXT fixes the scale at 1; the metric modes use a fixed
+    /// scale with y up; MM_ISOTROPIC uses one scale on both axes (the smaller magnitude, each axis's
+    /// sign kept); anisotropic and unknown modes use the extents as given.
+    fn ratios(&self) -> (f64, f64) {
+        if self.mode == MM_TEXT {
+            return (1.0, 1.0);
+        }
+        if let Some(mm) = metric_mm(self.mode) {
+            return (mm * self.px_mm.0, -mm * self.px_mm.1);
+        }
+        let (rx, ry) = (ratio(self.ve.0, self.we.0), ratio(self.ve.1, self.we.1));
+        if self.mode == MM_ISOTROPIC {
+            let s = rx.abs().min(ry.abs());
+            return (if rx < 0.0 { -s } else { s }, if ry < 0.0 { -s } else { s });
+        }
+        (rx, ry)
+    }
+
+    /// Approximate device length per logical length, for pen widths.
+    fn scale(&self) -> f64 {
+        let w = self.world;
+        let det = (w[0] * w[3] - w[1] * w[2]).abs().sqrt();
+        let (sx, sy) = self.ratios();
+        det * (sx.abs() + sy.abs()) / 2.0
+    }
+
+    /// True when the window-to-viewport extents set the scale (the isotropic and anisotropic modes).
+    pub fn uses_extents(&self) -> bool {
+        matches!(self.mode, MM_ISOTROPIC | MM_ANISOTROPIC)
+    }
+
+    pub fn window_ext(&self) -> P {
+        self.we
+    }
+
+    pub fn viewport_ext(&self) -> P {
+        self.ve
+    }
+
+    /// The window in device units as `[x, y, w, h]` with positive extents, used as the picture frame
+    /// of a plain WMF.
+    pub fn window_rect(&self) -> [f64; 4] {
+        let a = self.device(self.wo);
+        let b = self.device((self.wo.0 + self.we.0, self.wo.1 + self.we.1));
+        [a.0.min(b.0), a.1.min(b.1), (b.0 - a.0).abs(), (b.1 - a.1).abs()]
+    }
+}
+
+fn ratio(num: f64, den: f64) -> f64 {
+    if den == 0.0 { 1.0 } else { num / den }
+}
+
+/// Output of drawing, in device units. Path points are already mapped; `lib.rs` normalises them.
+pub(crate) enum Raw {
+    Path { ops: Vec<Op>, fill: Option<[u8; 4]>, stroke: Option<([u8; 4], f64)>, even_odd: bool },
+    Bitmap { rect: [f64; 4], img: Rgba },
+}
+
+#[derive(Clone)]
+struct Saved {
+    map: Mapping,
+    pen: Pen,
+    brush: Brush,
+    even_odd: bool,
+    nop: bool,
+}
+
+pub(crate) struct Canvas {
+    pub items: Vec<Raw>,
+    pub map: Mapping,
+    /// True once SETWINDOWEXT was seen, so a plain WMF has a frame to use.
+    pub window_set: bool,
+    /// True once the file set the viewport extent itself (not the player, see [`Canvas::play_into`]).
+    pub viewport_set: bool,
+    saved: Vec<Saved>,
+    /// Bytes held by the items so far (path ops and pixels), capped at [`MAX_BYTES`].
+    used: usize,
+    objects: Vec<Option<Obj>>,
+    pen: Pen,
+    brush: Brush,
+    even_odd: bool,
+    /// The mix mode is R2_NOP: shapes draw nothing.
+    nop: bool,
+    pos: P,
+    in_path: bool,
+    path: Vec<Op>,
+    full: bool,
+}
+
+impl Canvas {
+    pub fn new() -> Self {
+        Canvas {
+            items: Vec::new(),
+            map: Mapping::identity(),
+            window_set: false,
+            viewport_set: false,
+            saved: Vec::new(),
+            used: 0,
+            objects: Vec::new(),
+            pen: Pen { style: 0, width: 0.0, color: [0, 0, 0, 255] },
+            brush: Brush { style: BS_SOLID, color: [255, 255, 255, 255] },
+            even_odd: true,
+            nop: false,
+            pos: (0.0, 0.0),
+            in_path: false,
+            path: Vec::new(),
+            full: false,
+        }
+    }
+
+    /// True once the item cap is hit; the readers stop there and keep what they have.
+    pub fn full(&self) -> bool {
+        self.full
+    }
+
+    fn push(&mut self, raw: Raw) {
+        let cost = match &raw {
+            Raw::Path { ops, .. } => ops.len() * std::mem::size_of::<Op>(),
+            Raw::Bitmap { img, .. } => img.px.len(),
+        };
+        if self.items.len() >= MAX_ITEMS || self.used.saturating_add(cost) > MAX_BYTES {
+            self.full = true;
+        } else {
+            self.used += cost;
+            self.items.push(raw);
+        }
+    }
+
+    pub fn set_window_org(&mut self, p: P) {
+        self.map.wo = p;
+    }
+
+    pub fn set_window_ext(&mut self, e: P) {
+        self.map.we = e;
+        self.window_set = true;
+    }
+
+    pub fn set_viewport_org(&mut self, p: P) {
+        self.map.vo = p;
+    }
+
+    pub fn set_viewport_ext(&mut self, e: P) {
+        self.map.ve = e;
+        self.viewport_set = true;
+    }
+
+    /// Sets up the mapping the way a player does before it plays a WMF into a target: anisotropic,
+    /// `window` (`[x, y, w, h]` in logical units) onto a viewport of `size` at the origin. The file's
+    /// own window records then replace the window; the viewport stays unless the file sets one.
+    /// Without a window (a plain WMF) only the viewport extent is set: the map mode and viewport
+    /// origin stay the file's.
+    pub fn play_into(&mut self, window: Option<[f64; 4]>, size: P) {
+        if let Some([x, y, w, h]) = window {
+            self.map.mode = MM_ANISOTROPIC;
+            self.map.wo = (x, y);
+            self.map.we = (w, h);
+            self.map.vo = (0.0, 0.0);
+        }
+        self.map.ve = size;
+    }
+
+    pub fn set_map_mode(&mut self, mode: u32) {
+        self.map.mode = mode;
+    }
+
+    /// Device pixels per millimetre (x, y) for the metric map modes. Ignored unless both are positive.
+    pub fn set_device_mm(&mut self, px_mm: P) {
+        if px_mm.0.is_finite() && px_mm.1.is_finite() && px_mm.0 > 0.0 && px_mm.1 > 0.0 {
+            self.map.px_mm = px_mm;
+        }
+    }
+
+    pub fn set_polyfill(&mut self, mode: u32) {
+        self.even_odd = mode != WINDING;
+    }
+
+    /// SETROP2: only R2_NOP changes what is drawn (nothing); the other mix modes draw as copy.
+    pub fn set_rop2(&mut self, mode: u32) {
+        self.nop = mode == R2_NOP;
+    }
+
+    /// EMF SETWORLDTRANSFORM (`mode` 4) and MODIFYWORLDTRANSFORM (1 identity, 2 left, 3 right, 4 set).
+    /// An unknown mode leaves the world transform as it was.
+    pub fn modify_world(&mut self, x: Xform, mode: u32) {
+        match mode {
+            1 => self.map.world = IDENTITY,
+            2 => self.map.world = mul(x, self.map.world),
+            3 => self.map.world = mul(self.map.world, x),
+            4 => self.map.world = x,
+            _ => {}
+        }
+    }
+
+    /// Pushes the drawing state. Past [`MAX_STACK`] levels the parse stops, since later restores
+    /// could no longer match the file.
+    pub fn save_dc(&mut self) {
+        if self.saved.len() < MAX_STACK {
+            self.saved.push(Saved { map: self.map, pen: self.pen, brush: self.brush, even_odd: self.even_odd, nop: self.nop });
+        } else {
+            self.full = true;
+        }
+    }
+
+    /// Negative `n` pops `-n` levels; positive `n` restores absolute level `n`.
+    pub fn restore_dc(&mut self, n: i32) {
+        let idx = if n < 0 { self.saved.len().checked_sub(n.unsigned_abs() as usize) } else { (n as usize).checked_sub(1) };
+        let Some(idx) = idx else { return };
+        let Some(s) = self.saved.get(idx).cloned() else { return };
+        self.saved.truncate(idx);
+        self.map = s.map;
+        self.pen = s.pen;
+        self.brush = s.brush;
+        self.even_odd = s.even_odd;
+        self.nop = s.nop;
+    }
+
+    /// Stores an object in `slot` (EMF index), or in the first free slot (WMF handle table).
+    pub fn add_object(&mut self, slot: Option<usize>, obj: Obj) {
+        match slot {
+            Some(i) if i < MAX_OBJECTS => {
+                if self.objects.len() <= i {
+                    self.objects.resize(i + 1, None);
+                }
+                if let Some(s) = self.objects.get_mut(i) {
+                    *s = Some(obj);
+                }
+            }
+            Some(_) => {}
+            None => match self.objects.iter().position(Option::is_none) {
+                Some(i) => {
+                    if let Some(s) = self.objects.get_mut(i) {
+                        *s = Some(obj);
+                    }
+                }
+                None if self.objects.len() < MAX_OBJECTS => self.objects.push(Some(obj)),
+                None => {}
+            },
+        }
+    }
+
+    pub fn delete_object(&mut self, i: u32) {
+        if let Some(s) = self.objects.get_mut(i as usize) {
+            *s = None;
+        }
+    }
+
+    /// Selects an object by index; indices with the high bit set are stock objects.
+    pub fn select(&mut self, i: u32) {
+        if i & STOCK != 0 {
+            return self.select_stock(i & !STOCK);
+        }
+        match self.objects.get(i as usize).copied().flatten() {
+            Some(Obj::Pen(p)) => self.pen = p,
+            Some(Obj::Brush(b)) => self.brush = b,
+            Some(Obj::Other) | None => {}
+        }
+    }
+
+    fn select_stock(&mut self, i: u32) {
+        let white = [255, 255, 255, 255];
+        let black = [0, 0, 0, 255];
+        let gray = |v: u8| Brush { style: BS_SOLID, color: [v, v, v, 255] };
+        match i {
+            0 | 18 => self.brush = Brush { style: BS_SOLID, color: white },
+            1 => self.brush = gray(192),
+            2 => self.brush = gray(128),
+            3 => self.brush = gray(64),
+            4 => self.brush = Brush { style: BS_SOLID, color: black },
+            5 => self.brush = Brush { style: BS_NULL, color: black },
+            6 => self.pen = Pen { style: 0, width: 0.0, color: white },
+            7 | 19 => self.pen = Pen { style: 0, width: 0.0, color: black },
+            8 => self.pen = Pen { style: PS_NULL, width: 0.0, color: black },
+            _ => {}
+        }
+    }
+
+    fn map_op(&self, op: Op) -> Op {
+        match op {
+            Op::M(p) => Op::M(self.map.device(p)),
+            Op::L(p) => Op::L(self.map.device(p)),
+            Op::C(a, b, c) => Op::C(self.map.device(a), self.map.device(b), self.map.device(c)),
+            Op::Z => Op::Z,
+        }
+    }
+
+    fn fill_color(&self) -> Option<[u8; 4]> {
+        (self.brush.style == BS_SOLID).then_some(self.brush.color)
+    }
+
+    fn stroke_pen(&self) -> Option<([u8; 4], f64)> {
+        if (self.pen.style & PS_STYLE_MASK) == PS_NULL {
+            return None;
+        }
+        // A cosmetic pen (width 0) stays 0: the renderers draw that as a hairline.
+        let w = if self.pen.width == 0.0 { 0.0 } else { self.pen.width.abs() * self.map.scale() };
+        Some((self.pen.color, w))
+    }
+
+    fn push_path_ops(&mut self, ops: impl IntoIterator<Item = Op>) {
+        for op in ops {
+            if self.path.len() >= MAX_PATH_OPS {
+                return;
+            }
+            self.path.push(op);
+        }
+    }
+
+    /// Draws logical-space ops with the current pen (`stroke`) and brush (`fill`), or appends them to
+    /// the open path bracket, where fill and stroke wait for FILLPATH/STROKEPATH.
+    pub fn shape(&mut self, ops: &[Op], fill: bool, stroke: bool) {
+        let dev: Vec<Op> = ops.iter().map(|o| self.map_op(*o)).collect();
+        if self.in_path {
+            return self.push_path_ops(dev);
+        }
+        if self.nop {
+            return;
+        }
+        let fill = if fill { self.fill_color() } else { None };
+        let stroke = if stroke { self.stroke_pen() } else { None };
+        if (fill.is_none() && stroke.is_none()) || dev.len() < 2 {
+            return;
+        }
+        let even_odd = self.even_odd;
+        self.push(Raw::Path { ops: dev, fill, stroke, even_odd });
+    }
+
+    pub fn move_to(&mut self, p: P) {
+        if self.in_path {
+            self.push_path_ops([Op::M(self.map.device(p))]);
+        }
+        self.pos = p;
+    }
+
+    /// LINETO from the current point, then moves the current point to `p`.
+    pub fn line_to(&mut self, p: P) {
+        self.line_chain(&[p], false, true);
+    }
+
+    /// Lines from the current point through `pts` (POLYLINETO), or a polyline from the current point.
+    pub fn line_chain(&mut self, pts: &[P], fill: bool, stroke: bool) {
+        // Inside an open bracket the path already ends at the current point, so no MoveTo is needed.
+        let mut ops = if self.in_path && !self.path.is_empty() { Vec::new() } else { vec![Op::M(self.pos)] };
+        ops.extend(pts.iter().map(|p| Op::L(*p)));
+        if let Some(last) = pts.last() {
+            self.pos = *last;
+        }
+        self.shape(&ops, fill, stroke);
+    }
+
+    /// POLYBEZIER: cubic segments that start a new figure at `from`. The current point is unchanged.
+    pub fn bezier(&mut self, from: P, pts: &[P]) {
+        let mut ops = vec![Op::M(from)];
+        ops.extend(cubics(pts));
+        self.shape(&ops, false, true);
+    }
+
+    /// POLYBEZIERTO: cubic segments from the current point through groups of three control or end
+    /// points; the current point moves to the last point. Inside an open bracket the path already
+    /// ends at the current point, so no MoveTo is needed.
+    pub fn bezier_to(&mut self, pts: &[P]) {
+        let mut ops = if self.in_path && !self.path.is_empty() { Vec::new() } else { vec![Op::M(self.pos)] };
+        ops.extend(cubics(pts));
+        if let Some(last) = pts.last() {
+            self.pos = *last;
+        }
+        self.shape(&ops, false, true);
+    }
+
+    pub fn poly(&mut self, pts: &[P], close: bool, fill: bool, stroke: bool) {
+        let Some(first) = pts.first() else { return };
+        let mut ops = vec![Op::M(*first)];
+        ops.extend(pts.iter().skip(1).map(|p| Op::L(*p)));
+        if close {
+            ops.push(Op::Z);
+        }
+        self.shape(&ops, fill, stroke);
+    }
+
+    pub fn begin_path(&mut self) {
+        self.in_path = true;
+        self.path.clear();
+    }
+
+    pub fn end_path(&mut self) {
+        self.in_path = false;
+    }
+
+    pub fn close_figure(&mut self) {
+        if self.in_path {
+            self.push_path_ops([Op::Z]);
+        }
+    }
+
+    /// FILLPATH, STROKEPATH and STROKEANDFILLPATH: paints the bracketed path and empties it.
+    pub fn paint_path(&mut self, fill: bool, stroke: bool) {
+        let ops = std::mem::take(&mut self.path);
+        if self.nop {
+            return;
+        }
+        let fill = if fill { self.fill_color() } else { None };
+        let stroke = if stroke { self.stroke_pen() } else { None };
+        if ops.len() < 2 || (fill.is_none() && stroke.is_none()) {
+            return;
+        }
+        let even_odd = self.even_odd;
+        self.push(Raw::Path { ops, fill, stroke, even_odd });
+    }
+
+    /// Fills a logical rectangle `[l, t, r, b]` with the current brush (nothing when it is not solid).
+    pub fn fill_brush_rect(&mut self, rect: [f64; 4]) {
+        if let Some(color) = self.fill_color() {
+            self.fill_rect_with(rect, color);
+        }
+    }
+
+    /// Fills a logical rectangle `[l, t, r, b]` with a solid colour (ROP fills such as BLACKNESS).
+    pub fn fill_rect_with(&mut self, [l, t, r, b]: [f64; 4], color: [u8; 4]) {
+        let dev: Vec<Op> = crate::geom::rect(l, t, r, b).iter().map(|o| self.map_op(*o)).collect();
+        self.push(Raw::Path { ops: dev, fill: Some(color), stroke: None, even_odd: true });
+    }
+
+    /// Whether a raster operation draws without a source bitmap (PATCOPY, BLACKNESS, WHITENESS).
+    pub fn sourceless(rop: u32) -> bool {
+        matches!(rop, PATCOPY | BLACKNESS | WHITENESS)
+    }
+
+    /// Fills a logical rectangle `[x, y, w, h]` for a source-less raster operation. PATCOPY uses the
+    /// brush (when solid); the others fill black or white. Other operations are not handled here.
+    pub fn fill_rop(&mut self, [x, y, w, h]: [f64; 4], rop: u32) {
+        let rect = [x, y, x + w, y + h];
+        match rop {
+            PATCOPY => self.fill_brush_rect(rect),
+            BLACKNESS => self.fill_rect_with(rect, [0, 0, 0, 255]),
+            WHITENESS => self.fill_rect_with(rect, [255, 255, 255, 255]),
+            _ => {}
+        }
+    }
+
+    /// A bitmap stretched into a logical rectangle `[x, y, w, h]`. A negative extent mirrors the
+    /// bitmap, as the mapping does.
+    pub fn bitmap(&mut self, rect: [f64; 4], mut img: Rgba) {
+        let [x, y, w, h] = rect;
+        let a = self.map.device((x, y));
+        let b = self.map.device((x + w, y + h));
+        crate::dib::flip(&mut img, a.0 > b.0, a.1 > b.1);
+        let dev = [a.0.min(b.0), a.1.min(b.1), (b.0 - a.0).abs(), (b.1 - a.1).abs()];
+        self.push(Raw::Bitmap { rect: dev, img });
+    }
+}
+
+/// Cubic segments from groups of three points (control, control, end). A trailing partial group is
+/// dropped.
+fn cubics(pts: &[P]) -> Vec<Op> {
+    let mut ops = Vec::with_capacity(pts.len() / 3);
+    let mut it = pts.iter().copied();
+    while let (Some(a), Some(b), Some(e)) = (it.next(), it.next(), it.next()) {
+        ops.push(Op::C(a, b, e));
+    }
+    ops
+}

crates/metafile/src/dib.rs

@@ -0,0 +1,259 @@
+//! Device-independent bitmaps. BITMAPINFOHEADER DIBs at 1/4/8/16/24/32 bpp with BI_RGB or BI_BITFIELDS
+//! decode to RGBA8 rows, top-down. Compressed (RLE, JPEG, PNG) and V4/V5-only features are not decoded.
+
+use crate::{MAX_PIXELS, bytes::Bytes};
+
+const BI_RGB: u32 = 0;
+const BI_BITFIELDS: u32 = 3;
+/// Most palette entries a DIB can carry (the colour table never exceeds 2^8).
+const MAX_PALETTE: usize = 256;
+const ROP_SRCAND: u32 = 0x0088_00C6;
+const ROP_SRCPAINT: u32 = 0x00EE_0086;
+const ROP_SRCINVERT: u32 = 0x0066_0046;
+
+/// A decoded picture. `bottom_up` records the DIB's native row order, which source rectangles use.
+pub(crate) struct Rgba {
+    pub w: usize,
+    pub h: usize,
+    pub bottom_up: bool,
+    pub px: Vec<u8>,
+}
+
+/// How a decoded bitmap combines with the destination.
+#[derive(Clone, Copy)]
+pub(crate) enum Blend {
+    /// A raster operation (BITBLT, STRETCHDIB and friends).
+    Rop(u32),
+    /// EMR_ALPHABLEND: a constant alpha (0..=255), times the per-pixel alpha when `per_pixel` is set
+    /// (AC_SRC_ALPHA: the source colours are premultiplied by it).
+    Alpha { constant: u8, per_pixel: bool },
+}
+
+impl Blend {
+    /// Whether the decoder must keep the 32-bit alpha byte of each pixel.
+    pub fn per_pixel(self) -> bool {
+        matches!(self, Blend::Alpha { per_pixel: true, .. })
+    }
+}
+
+struct Header {
+    w: usize,
+    h: usize,
+    top_down: bool,
+    bpp: usize,
+    masks: [u32; 3],
+    pal_off: usize,
+    pal_n: usize,
+}
+
+impl Header {
+    fn read(info: Bytes) -> Option<Header> {
+        let size = info.u32(0)? as usize;
+        let w = info.i32(4)?;
+        let h = info.i32(8)?;
+        let bpp = info.u16(14)? as usize;
+        let comp = info.u32(16)?;
+        let clr_used = info.u32(32)? as usize;
+        if size < 40 || w <= 0 || h == 0 || !matches!(bpp, 1 | 4 | 8 | 16 | 24 | 32) || !matches!(comp, BI_RGB | BI_BITFIELDS) {
+            return None;
+        }
+        let masks = if comp == BI_BITFIELDS {
+            [info.u32(40)?, info.u32(44)?, info.u32(48)?]
+        } else if bpp == 16 {
+            [0x7C00, 0x03E0, 0x001F]
+        } else {
+            [0xFF_0000, 0xFF00, 0xFF]
+        };
+        let masks_len = if comp == BI_BITFIELDS && size == 40 { 12 } else { 0 };
+        let pal_off = size.checked_add(masks_len)?;
+        // Indexed formats take 2^bpp entries when clrUsed is 0. Deeper formats carry only the
+        // entries clrUsed names (WMF DIBs can have them), still capped.
+        let pal_n = match (bpp <= 8, clr_used) {
+            (true, 0) => 1usize << bpp,
+            (true, n) => n.min(1usize << bpp),
+            (false, n) => n.min(MAX_PALETTE),
+        };
+        Some(Header { w: w as usize, h: h.unsigned_abs() as usize, top_down: h < 0, bpp, masks, pal_off, pal_n })
+    }
+}
+
+/// Byte length of the info part (header, masks, palette) of a DIB, so the pixel bits follow it.
+pub(crate) fn info_len(dib: Bytes) -> Option<usize> {
+    let h = Header::read(dib)?;
+    h.pal_off.checked_add(h.pal_n.checked_mul(4)?)
+}
+
+/// Decodes a DIB given as its info part (header plus masks and palette) and its pixel bits. The
+/// 32-bit alpha byte is kept only when `keep_alpha` is set (per-pixel alpha blends); otherwise pixels
+/// are opaque.
+pub(crate) fn decode(info: Bytes, bits: Bytes, keep_alpha: bool) -> Option<Rgba> {
+    let hd = Header::read(info)?;
+    let pixels = hd.w.checked_mul(hd.h)?;
+    if pixels == 0 || pixels > MAX_PIXELS {
+        return None;
+    }
+    let stride = hd.w.checked_mul(hd.bpp)?.checked_add(31)? / 32 * 4;
+    let data = bits.slice(0, stride.checked_mul(hd.h)?)?;
+    let pal = info.slice(hd.pal_off, hd.pal_n * 4)?;
+    let mut px = vec![0u8; pixels * 4];
+    for y in 0..hd.h {
+        let src_row = if hd.top_down { y } else { hd.h - 1 - y };
+        let row = src_row * stride;
+        for x in 0..hd.w {
+            let p = pixel(data, row, x, &hd, pal, keep_alpha)?;
+            let o = (y * hd.w + x) * 4;
+            px.get_mut(o..o + 4)?.copy_from_slice(&p);
+        }
+    }
+    Some(Rgba { w: hd.w, h: hd.h, bottom_up: !hd.top_down, px })
+}
+
+fn pixel(data: &[u8], row: usize, x: usize, hd: &Header, pal: &[u8], keep_alpha: bool) -> Option<[u8; 4]> {
+    let [m_r, m_g, m_b] = hd.masks;
+    let [r, g, b] = match hd.bpp {
+        1 => {
+            let b = *data.get(row + x / 8)?;
+            palette(pal, usize::from((b >> (7 - x % 8)) & 1))
+        }
+        4 => {
+            let b = *data.get(row + x / 2)?;
+            palette(pal, usize::from(if x.is_multiple_of(2) { b >> 4 } else { b & 0x0F }))
+        }
+        8 => palette(pal, usize::from(*data.get(row + x)?)),
+        24 => {
+            let [b, g, r] = data.get(row + x * 3..row + x * 3 + 3)?.try_into().ok()?;
+            [r, g, b]
+        }
+        16 => {
+            let o = row + x * 2;
+            let v = u32::from(u16::from_le_bytes(data.get(o..o + 2)?.try_into().ok()?));
+            [field(v, m_r), field(v, m_g), field(v, m_b)]
+        }
+        _ => {
+            let o = row + x * 4;
+            let v = u32::from_le_bytes(data.get(o..o + 4)?.try_into().ok()?);
+            let a = if keep_alpha { (v >> 24) as u8 } else { 255 };
+            return Some([field(v, m_r), field(v, m_g), field(v, m_b), a]);
+        }
+    };
+    Some([r, g, b, 255])
+}
+
+/// Palette entries are BGRX quads; an index past the table reads as black rather than failing the image.
+fn palette(pal: &[u8], i: usize) -> [u8; 3] {
+    pal.get(i * 4..i * 4 + 4).and_then(|c| <[u8; 4]>::try_from(c).ok()).map_or([0, 0, 0], |c| [c[2], c[1], c[0]])
+}
+
+/// Extracts one channel from a masked pixel value and scales it to 8 bits.
+fn field(v: u32, mask: u32) -> u8 {
+    if mask == 0 {
+        return 0;
+    }
+    let shift = mask.trailing_zeros();
+    let max = u64::from(mask >> shift);
+    let val = u64::from((v & mask) >> shift);
+    ((val * 255 + max / 2) / max) as u8
+}
+
+/// Clips a source rectangle `src` = `[x, y, w, h]` to the bitmap and returns the cropped pixels (top-down)
+/// with the part of the destination `dst` that they fill. `src` is in DIB pixel coordinates (`y` counted
+/// from the DIB's origin, so bottom-up images count from the bottom); a non-positive source size means the
+/// whole bitmap. Clipping shrinks the destination by the same ratio and shifts it by the clipped-off part,
+/// so the rest of the image keeps its place. A negative destination extent is kept (the caller mirrors).
+pub(crate) fn clip_blit(img: &Rgba, src: [i64; 4], dst: [f64; 4]) -> Option<(Rgba, [f64; 4])> {
+    let (iw, ih) = (img.w as i64, img.h as i64);
+    let [sx, sy, sw, sh] = if src[2] > 0 && src[3] > 0 { src } else { [0, 0, iw, ih] };
+    // The request's top row in top-down order.
+    let top = if img.bottom_up { ih.saturating_sub(sy).saturating_sub(sh) } else { sy };
+    let (x0, x1) = (sx.max(0), sx.saturating_add(sw).min(iw));
+    let (r0, r1) = (top.max(0), top.saturating_add(sh).min(ih));
+    if x1 <= x0 || r1 <= r0 {
+        return None;
+    }
+    let (kx, ky) = (dst[2] / sw as f64, dst[3] / sh as f64);
+    let out = [dst[0] + (x0 - sx) as f64 * kx, dst[1] + (r0 - top) as f64 * ky, (x1 - x0) as f64 * kx, (r1 - r0) as f64 * ky];
+    let (x0, x1, r0, r1) = (x0 as usize, x1 as usize, r0 as usize, r1 as usize);
+    let (ow, oh) = (x1 - x0, r1 - r0);
+    let mut px = Vec::with_capacity(ow * oh * 4);
+    for row in r0..r1 {
+        let s = (row * img.w + x0) * 4;
+        px.extend_from_slice(img.px.get(s..s + ow * 4)?);
+    }
+    Some((Rgba { w: ow, h: oh, bottom_up: false, px }, out))
+}
+
+/// Applies a blend to decoded pixels before they are drawn. The picture has no destination pixels, so
+/// raster operations are drawn as they look over white paper: SRCAND (destination AND source) leaves
+/// white source pixels out and draws the rest; SRCPAINT and SRCINVERT leave black ones out. Other
+/// operations draw the source as copied. Constant alpha scales every pixel's alpha, after a
+/// per-pixel (premultiplied) source is made straight.
+pub(crate) fn prepare(img: &mut Rgba, blend: Blend) {
+    match blend {
+        Blend::Rop(ROP_SRCAND) => clear_where(img, [255, 255, 255]),
+        Blend::Rop(ROP_SRCPAINT | ROP_SRCINVERT) => clear_where(img, [0, 0, 0]),
+        Blend::Rop(_) => {}
+        Blend::Alpha { constant, per_pixel } => {
+            for p in img.px.as_chunks_mut::<4>().0 {
+                if per_pixel {
+                    unpremultiply(p);
+                }
+                p[3] = (u16::from(p[3]) * u16::from(constant) / 255) as u8;
+            }
+        }
+    }
+}
+
+/// Makes the pixels of colour `rgb` transparent: where a raster operation keeps the destination.
+fn clear_where(img: &mut Rgba, rgb: [u8; 3]) {
+    for p in img.px.as_chunks_mut::<4>().0 {
+        if p[..3] == rgb {
+            p[3] = 0;
+        }
+    }
+}
+
+/// AC_SRC_ALPHA sources are premultiplied; the model holds straight RGBA, so divide the colour by the
+/// alpha (rounded, capped at 255). A transparent pixel keeps its colour bytes.
+fn unpremultiply(p: &mut [u8; 4]) {
+    let a = u32::from(p[3]);
+    if a == 0 || a == 255 {
+        return;
+    }
+    for c in &mut p[..3] {
+        *c = ((u32::from(*c) * 255 + a / 2) / a).min(255) as u8;
+    }
+}
+
+/// Mirrors a decoded image left-right and/or top-bottom. Rows come from the buffer as chunks, so a
+/// short buffer flips only the rows it has.
+pub(crate) fn flip(img: &mut Rgba, horizontal: bool, vertical: bool) {
+    let (w, h) = (img.w, img.h);
+    if w == 0 || h == 0 {
+        return;
+    }
+    let row = w * 4;
+    if horizontal {
+        for line in img.px.chunks_exact_mut(row) {
+            for x in 0..w / 2 {
+                for c in 0..4 {
+                    line.swap(x * 4 + c, (w - 1 - x) * 4 + c);
+                }
+            }
+        }
+    }
+    if vertical {
+        // Rows the buffer actually holds: a short buffer flips only those.
+        let n = h.min(img.px.len() / row);
+        for y in 0..n / 2 {
+            swap_rows(&mut img.px, y * row, (n - 1 - y) * row, row);
+        }
+    }
+}
+
+/// Swaps the `len` bytes at `a` with those at `b` (`a < b`); does nothing when either is out of range.
+fn swap_rows(px: &mut [u8], a: usize, b: usize, len: usize) {
+    let Some((head, tail)) = px.split_at_mut_checked(b) else { return };
+    if let (Some(top), Some(bottom)) = (head.get_mut(a..a.saturating_add(len)), tail.get_mut(..len)) {
+        top.swap_with_slice(bottom);
+    }
+}

crates/metafile/src/emf.rs

@@ -0,0 +1,315 @@
+//! EMF reader (MS-EMF). Records are (type, size in bytes) followed by a payload; offsets inside a
+//! record (bitmap info and bits) are relative to the record start, so each handler reads the record slice.
+
+use crate::bytes::Bytes;
+use crate::canvas::{BS_NULL, Brush, Canvas, Obj, PS_NULL, PS_STYLE_MASK, Pen, Xform, colorref};
+use crate::dib::{self, Blend};
+use crate::geom::{self, ArcKind, P};
+use crate::{Error, Frame, MAX_PATH_OPS};
+
+const EMF_SIGNATURE: u32 = 0x464D_4520;
+/// Hundredths of a millimetre to points.
+const HMM_TO_PT: f64 = 72.0 / 2540.0;
+/// SRCCOPY, the plain copy of a bitmap.
+const SRCCOPY: u32 = 0x00CC_0020;
+/// LogPenEx pen type bits; PS_COSMETIC pens are one device pixel wide.
+const PS_TYPE_MASK: u32 = 0x000F_0000;
+const PS_COSMETIC: u32 = 0;
+
+pub(crate) fn is_emf(b: Bytes) -> bool {
+    b.u32(0) == Some(1) && b.u32(40) == Some(EMF_SIGNATURE)
+}
+
+/// The picture frame: `rclFrame` (0.01 mm) mapped to device units through `szlDevice` and
+/// `szlMillimeters`, sized in points. Without a usable frame, the device bounds stand in (1 unit = 1 point).
+pub(crate) fn parse(input: Bytes) -> Result<(Canvas, Option<Frame>), Error> {
+    if !is_emf(input) {
+        return Err(Error::BadHeader);
+    }
+    let hsize = input.u32(4).ok_or(Error::BadHeader)? as usize;
+    let bounds = rect32(input, 8).ok_or(Error::BadHeader)?;
+    let [l, t, r, b] = bounds;
+    let frame = frame_from_header(input).or_else(|| (r > l && b > t).then_some(Frame { rect: [l, t, r - l, b - t], size: None }));
+    let mut cv = Canvas::new();
+    if let Some(px_mm) = device_px_per_mm(input) {
+        cv.set_device_mm(px_mm);
+    }
+    let mut parsed = 0usize;
+    let mut pos = hsize.max(88);
+    while !cv.full() {
+        let (Some(typ), Some(size)) = (input.u32(pos), pos.checked_add(4).and_then(|o| input.u32(o))) else { break };
+        let size = size as usize;
+        if size < 8 || !size.is_multiple_of(4) {
+            break;
+        }
+        let Some(rec) = input.slice(pos, size) else { break };
+        if typ == 14 {
+            break;
+        }
+        record(&mut cv, typ, Bytes(rec));
+        parsed += 1;
+        let Some(next) = pos.checked_add(size) else { break };
+        pos = next;
+    }
+    if parsed == 0 {
+        return Err(Error::NoRecords);
+    }
+    Ok((cv, frame))
+}
+
+/// Device pixels per millimetre on each axis, from `szlDevice` (72) and `szlMillimeters` (80).
+fn device_px_per_mm(input: Bytes) -> Option<(f64, f64)> {
+    let (dw, dh) = (input.i32(72)?, input.i32(76)?);
+    let (mw, mh) = (input.i32(80)?, input.i32(84)?);
+    (dw > 0 && dh > 0 && mw > 0 && mh > 0).then(|| (f64::from(dw) / f64::from(mw), f64::from(dh) / f64::from(mh)))
+}
+
+/// The frame from `rclFrame` (offset 24), `szlDevice` (72) and `szlMillimeters` (80) in the header.
+fn frame_from_header(input: Bytes) -> Option<Frame> {
+    let [fl, ft, fr, fb] = rect32(input, 24)?;
+    if fr <= fl || fb <= ft {
+        return None;
+    }
+    // Device units per hundredth of a millimetre.
+    let (px_mm_x, px_mm_y) = device_px_per_mm(input)?;
+    let (sx, sy) = (px_mm_x / 100.0, px_mm_y / 100.0);
+    let rect = [fl * sx, ft * sy, (fr - fl) * sx, (fb - ft) * sy];
+    Some(Frame { rect, size: Some(((fr - fl) * HMM_TO_PT, (fb - ft) * HMM_TO_PT)) })
+}
+
+fn record(cv: &mut Canvas, typ: u32, r: Bytes) {
+    if cv.full() {
+        return;
+    }
+    let _ = match typ {
+        9 => xy32(r, 8).map(|p| cv.set_window_ext(p)),
+        10 => xy32(r, 8).map(|p| cv.set_window_org(p)),
+        11 => xy32(r, 8).map(|p| cv.set_viewport_ext(p)),
+        12 => xy32(r, 8).map(|p| cv.set_viewport_org(p)),
+        17 => r.u32(8).map(|m| cv.set_map_mode(m)),
+        19 => r.u32(8).map(|m| cv.set_polyfill(m)),
+        20 => r.u32(8).map(|m| cv.set_rop2(m)),
+        33 => {
+            cv.save_dc();
+            Some(())
+        }
+        34 => r.i32(8).map(|n| cv.restore_dc(n)),
+        35 => xform(r, 8).map(|x| cv.modify_world(x, 4)),
+        36 => xform(r, 8).zip(r.u32(32)).map(|(x, m)| cv.modify_world(x, m)),
+        37 => r.u32(8).map(|i| cv.select(i)),
+        38 => create_pen(cv, r),
+        95 => create_ext_pen(cv, r),
+        39 => create_brush(cv, r),
+        40 => r.u32(8).map(|i| cv.delete_object(i)),
+        27 => xy32(r, 8).map(|p| cv.move_to(p)),
+        54 => xy32(r, 8).map(|p| cv.line_to(p)),
+        42 => rect32(r, 8).map(|[l, t, rr, b]| cv.shape(&geom::ellipse(l, t, rr, b), true, true)),
+        43 => rect32(r, 8).map(|[l, t, rr, b]| cv.shape(&geom::rect(l, t, rr, b), true, true)),
+        44 => {
+            let (cw, ch) = (r.i32(24), r.i32(28));
+            let (Some(cw), Some(ch)) = (cw, ch) else { return };
+            rect32(r, 8).map(|[l, t, rr, b]| {
+                cv.shape(&geom::round_rect(l, t, rr, b, f64::from(cw), f64::from(ch)), true, true);
+            })
+        }
+        45..=47 => arc32(r).map(|(bounds, s, e)| {
+            let kind = match typ {
+                45 => ArcKind::Arc,
+                46 => ArcKind::Chord,
+                _ => ArcKind::Pie,
+            };
+            let [l, t, rr, b] = bounds;
+            cv.shape(&geom::arc_shape(l, t, rr, b, s, e, kind), kind != ArcKind::Arc, true);
+        }),
+        4 | 87 => counted(r, typ == 4).map(|pts| cv.poly(&pts, false, false, true)),
+        3 | 86 => counted(r, typ == 3).map(|pts| cv.poly(&pts, true, true, true)),
+        6 | 89 => counted(r, typ == 6).map(|pts| cv.line_chain(&pts, false, true)),
+        // POLYBEZIER starts its own figure at the first point and leaves the current point alone;
+        // POLYBEZIERTO continues from the current point.
+        2 | 85 => counted(r, typ == 2).and_then(|pts| {
+            let from = *pts.first()?;
+            cv.bezier(from, pts.get(1..)?);
+            Some(())
+        }),
+        5 | 88 => counted(r, typ == 5).map(|pts| cv.bezier_to(&pts)),
+        7 | 90 => poly_groups(r, typ == 7).map(|(counts, pts)| cv.shape(&geom::subpaths(&pts, &counts, false), false, true)),
+        8 | 91 => poly_groups(r, typ == 8).map(|(counts, pts)| cv.shape(&geom::subpaths(&pts, &counts, true), true, true)),
+        59 => {
+            cv.begin_path();
+            Some(())
+        }
+        60 => {
+            cv.end_path();
+            Some(())
+        }
+        61 => {
+            cv.close_figure();
+            Some(())
+        }
+        62 => {
+            cv.paint_path(true, false);
+            Some(())
+        }
+        63 => {
+            cv.paint_path(true, true);
+            Some(())
+        }
+        64 => {
+            cv.paint_path(false, true);
+            Some(())
+        }
+        76 | 77 => bitblt(cv, r, typ == 77),
+        80 => set_dibits(cv, r),
+        81 => stretch_dibits(cv, r),
+        114 => alphablend(cv, r),
+        _ => Some(()),
+    };
+}
+
+/// Two little-endian i32 values at `off`, as a point.
+fn xy32(r: Bytes, off: usize) -> Option<P> {
+    Some((f64::from(r.i32(off)?), f64::from(r.i32(off + 4)?)))
+}
+
+/// RECTL (left, top, right, bottom) as i32 values widened to f64.
+fn rect32(r: Bytes, off: usize) -> Option<[f64; 4]> {
+    Some([f64::from(r.i32(off)?), f64::from(r.i32(off + 4)?), f64::from(r.i32(off + 8)?), f64::from(r.i32(off + 12)?)])
+}
+
+/// An i32 field as f64; 0 past the end.
+fn i32s(r: Bytes, off: usize) -> f64 {
+    r.i32(off).map_or(0.0, f64::from)
+}
+
+/// XFORM: six f32 values in M11, M12, M21, M22, Dx, Dy order.
+fn xform(r: Bytes, off: usize) -> Option<Xform> {
+    let mut x = [0.0f64; 6];
+    for (i, v) in x.iter_mut().enumerate() {
+        *v = f64::from(r.f32(off + i * 4)?);
+    }
+    Some(x)
+}
+
+/// ARC, CHORD, PIE: bounds at 8, start point at 24, end point at 32.
+fn arc32(r: Bytes) -> Option<([f64; 4], P, P)> {
+    Some((rect32(r, 8)?, xy32(r, 24)?, xy32(r, 32)?))
+}
+
+/// A point count from a record, rejected when it exceeds the path budget (before any allocation).
+fn budget(n: u32) -> Option<usize> {
+    let n = n as usize;
+    (n <= MAX_PATH_OPS).then_some(n)
+}
+
+/// Point count at 24, then the points (32-bit or 16-bit) at 28.
+fn counted(r: Bytes, wide: bool) -> Option<Vec<P>> {
+    let n = budget(r.u32(24)?)?;
+    r.tail(28)?.points(0, n, wide)
+}
+
+/// Subpath count at 24, total point count at 28, per-subpath counts at 32, then the points.
+fn poly_groups(r: Bytes, wide: bool) -> Option<(Vec<usize>, Vec<P>)> {
+    let n = budget(r.u32(24)?)?;
+    // The record must hold the n counts before anything is allocated for them.
+    let raw = r.slice(32, n.checked_mul(4)?)?;
+    let counts: Vec<usize> = raw.as_chunks::<4>().0.iter().map(|c| u32::from_le_bytes(*c) as usize).collect();
+    let total = counts.iter().try_fold(0usize, |a, c| a.checked_add(*c))?;
+    let total = budget(u32::try_from(total).ok()?)?;
+    let pts = r.tail(n.checked_mul(4)?.checked_add(32)?)?.points(0, total, wide)?;
+    Some((counts, pts))
+}
+
+/// EMR_CREATEPEN: handle, LogPen (style, width x/y, colour).
+fn create_pen(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let style = r.u32(12)?;
+    let width = r.i32(16)?;
+    let color = r.u32(24)?;
+    cv.add_object(Some(slot), Obj::Pen(Pen { style, width: f64::from(width), color: colorref(color) }));
+    Some(())
+}
+
+/// EMR_EXTCREATEPEN: handle, bitmap offsets (unused), LogPenEx (style, width, brush style, colour).
+/// A cosmetic pen's width is in device pixels (always 1), so it is a hairline; a BS_NULL brush draws
+/// no line at all.
+fn create_ext_pen(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let (style, width, brush, color) = (r.u32(28)?, r.u32(32)?, r.u32(36)?, r.u32(40)?);
+    let width = if style & PS_TYPE_MASK == PS_COSMETIC { 0.0 } else { f64::from(width) };
+    let style = if brush == BS_NULL { PS_NULL } else { style & PS_STYLE_MASK };
+    cv.add_object(Some(slot), Obj::Pen(Pen { style, width, color: colorref(color) }));
+    Some(())
+}
+
+/// EMR_CREATEBRUSHINDIRECT: handle, LogBrush32 (style, colour, hatch).
+fn create_brush(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let slot = r.u32(8)? as usize;
+    let style = r.u32(12)?;
+    let color = r.u32(16)?;
+    cv.add_object(Some(slot), Obj::Brush(Brush { style, color: colorref(color) }));
+    Some(())
+}
+
+/// BITBLT (76) and STRETCHBLT (77): dest at 24..40, rop at 40, source x/y at 44, bmi at 84, bits at
+/// 92; STRETCHBLT adds the source w/h at 100. A source-less rop fills the destination instead.
+fn bitblt(cv: &mut Canvas, r: Bytes, stretch: bool) -> Option<()> {
+    let dst = [i32s(r, 24), i32s(r, 28), i32s(r, 32), i32s(r, 36)];
+    let rop = r.u32(40)?;
+    if Canvas::sourceless(rop) {
+        cv.fill_rop(dst, rop);
+        return Some(());
+    }
+    let (sw, sh) = if stretch { (i32s(r, 100), i32s(r, 104)) } else { (dst[2], dst[3]) };
+    let src = [i32s(r, 44), i32s(r, 48), sw, sh];
+    blit(cv, r, dst, src, (84, 92), Blend::Rop(rop))
+}
+
+/// ALPHABLEND: laid out like STRETCHBLT, with a BLENDFUNCTION at 40. Constant alpha at 42 applies to
+/// every pixel; AlphaFormat at 43 with AC_SRC_ALPHA (1) also uses the per-pixel alpha.
+fn alphablend(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let dst = [i32s(r, 24), i32s(r, 28), i32s(r, 32), i32s(r, 36)];
+    let constant = *r.0.get(42)?;
+    let per_pixel = (*r.0.get(43)? & 0x01) != 0;
+    let src = [i32s(r, 44), i32s(r, 48), i32s(r, 100), i32s(r, 104)];
+    blit(cv, r, dst, src, (84, 92), Blend::Alpha { constant, per_pixel })
+}
+
+/// STRETCHDIBITS: dest x/y at 24, src x/y/w/h at 32..48, bmi offset/size at 48, bits at 56, rop at 68,
+/// dest w/h at 72.
+fn stretch_dibits(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let dst = [i32s(r, 24), i32s(r, 28), i32s(r, 72), i32s(r, 76)];
+    let src = [i32s(r, 32), i32s(r, 36), i32s(r, 40), i32s(r, 44)];
+    let rop = r.u32(68)?;
+    blit(cv, r, dst, src, (48, 56), Blend::Rop(rop))
+}
+
+/// SETDIBITSTODEVICE (MS-EMF 2.3.1.5): dest x/y at 24, src x/y at 32, size (cxSrc, cySrc) at 40, bmi
+/// at 48, bits at 56, start scan at 68. The image keeps its own size; the bits begin at scan line
+/// `iStartScan`, so the source y counts from there.
+fn set_dibits(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let (cx, cy) = (i32s(r, 40), i32s(r, 44));
+    if cx <= 0.0 || cy <= 0.0 {
+        return None;
+    }
+    let dst = [i32s(r, 24), i32s(r, 28), cx, cy];
+    let src = [i32s(r, 32), i32s(r, 36) - f64::from(r.u32(68)?), cx, cy];
+    blit(cv, r, dst, src, (48, 56), Blend::Rop(SRCCOPY))
+}
+
+/// Decodes the bitmap at `at` = (offset of the bmi offset/length pair, offset of the bits pair), both
+/// inside the record, and stretches the source rectangle `src` into `dst`. Both are `[x, y, w, h]`; a
+/// non-positive source size means the whole bitmap. `blend` decides how it combines.
+fn blit(cv: &mut Canvas, r: Bytes, dst: [f64; 4], src: [f64; 4], at: (usize, usize), blend: Blend) -> Option<()> {
+    let (bo, bl) = (r.u32(at.0)? as usize, r.u32(at.0 + 4)? as usize);
+    let (po, pl) = (r.u32(at.1)? as usize, r.u32(at.1 + 4)? as usize);
+    if pl == 0 {
+        return None;
+    }
+    let info = Bytes(r.slice(bo, bl)?);
+    let pixels = Bytes(r.slice(po, pl)?);
+    let mut img = dib::decode(info, pixels, blend.per_pixel())?;
+    dib::prepare(&mut img, blend);
+    let (img, dst) = dib::clip_blit(&img, src.map(|v| v as i64), dst)?;
+    cv.bitmap(dst, img);
+    Some(())
+}

crates/metafile/src/geom.rs

@@ -0,0 +1,118 @@
+//! Path operations in `f64` and the shape builders that turn WMF/EMF rectangles, ellipses and arcs
+//! into cubic Béziers (the classic 4/3·tan(Δ/4) approximation, at most 90° per piece).
+
+use std::f64::consts::{FRAC_PI_2, PI, TAU};
+
+pub(crate) type P = (f64, f64);
+
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(crate) enum Op {
+    M(P),
+    L(P),
+    C(P, P, P),
+    Z,
+}
+
+pub(crate) fn rect(l: f64, t: f64, r: f64, b: f64) -> Vec<Op> {
+    vec![Op::M((l, t)), Op::L((r, t)), Op::L((r, b)), Op::L((l, b)), Op::Z]
+}
+
+/// Corner radii are half the EMF/WMF corner ellipse size, clamped so the corners never overlap.
+pub(crate) fn round_rect(l: f64, t: f64, r: f64, b: f64, ew: f64, eh: f64) -> Vec<Op> {
+    // Reversed corners (right < left, bottom < top) describe the same rectangle.
+    let (l, r) = (l.min(r), l.max(r));
+    let (t, b) = (t.min(b), t.max(b));
+    let rx = (ew / 2.0).abs().min((r - l) / 2.0);
+    let ry = (eh / 2.0).abs().min((b - t) / 2.0);
+    let mut ops = vec![Op::M((l + rx, t)), Op::L((r - rx, t))];
+    ops.extend(arc(r - rx, t + ry, rx, ry, -FRAC_PI_2, FRAC_PI_2));
+    ops.push(Op::L((r, b - ry)));
+    ops.extend(arc(r - rx, b - ry, rx, ry, 0.0, FRAC_PI_2));
+    ops.push(Op::L((l + rx, b)));
+    ops.extend(arc(l + rx, b - ry, rx, ry, FRAC_PI_2, FRAC_PI_2));
+    ops.push(Op::L((l, t + ry)));
+    ops.extend(arc(l + rx, t + ry, rx, ry, PI, FRAC_PI_2));
+    ops.push(Op::Z);
+    ops
+}
+
+pub(crate) fn ellipse(l: f64, t: f64, r: f64, b: f64) -> Vec<Op> {
+    let (cx, cy, rx, ry) = center(l, t, r, b);
+    let mut ops = vec![Op::M((cx + rx, cy))];
+    ops.extend(arc(cx, cy, rx, ry, 0.0, TAU));
+    ops.push(Op::Z);
+    ops
+}
+
+/// Which closed or open shape an ARC/CHORD/PIE record draws.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ArcKind {
+    Arc,
+    Chord,
+    Pie,
+}
+
+/// ARC, CHORD and PIE: the arc runs counter-clockwise on screen from the start point to the end point.
+pub(crate) fn arc_shape(l: f64, t: f64, r: f64, b: f64, s: P, e: P, kind: ArcKind) -> Vec<Op> {
+    let (cx, cy, rx, ry) = center(l, t, r, b);
+    let ang = |p: P| ((p.1 - cy) / ry.max(f64::MIN_POSITIVE)).atan2((p.0 - cx) / rx.max(f64::MIN_POSITIVE));
+    let (a0, a1) = (ang(s), ang(e));
+    let mut d = (a0 - a1).rem_euclid(TAU);
+    if d < 1e-12 {
+        d = TAU;
+    }
+    let sweep = -d;
+    let start = (cx + rx * a0.cos(), cy + ry * a0.sin());
+    let mut ops = if kind == ArcKind::Pie { vec![Op::M((cx, cy)), Op::L(start)] } else { vec![Op::M(start)] };
+    ops.extend(arc(cx, cy, rx, ry, a0, sweep));
+    match kind {
+        ArcKind::Arc => {}
+        ArcKind::Chord => ops.push(Op::Z),
+        ArcKind::Pie => ops.extend([Op::L((cx, cy)), Op::Z]),
+    }
+    ops
+}
+
+fn center(l: f64, t: f64, r: f64, b: f64) -> (f64, f64, f64, f64) {
+    ((l + r) / 2.0, (t + b) / 2.0, (r - l).abs() / 2.0, (b - t).abs() / 2.0)
+}
+
+/// Cubic pieces along an ellipse from parameter `a0` over signed `sweep` radians. The current point
+/// must already be at `(cx + rx cos a0, cy + ry sin a0)`.
+fn arc(cx: f64, cy: f64, rx: f64, ry: f64, a0: f64, sweep: f64) -> Vec<Op> {
+    let n = ((sweep.abs() / FRAC_PI_2).ceil() as usize).clamp(1, 8);
+    let step = sweep / n as f64;
+    let k = 4.0 / 3.0 * (step / 4.0).tan();
+    let pt = |t: f64| (cx + rx * t.cos(), cy + ry * t.sin());
+    let mut ops = Vec::with_capacity(n);
+    for i in 0..n {
+        let t0 = a0 + step * i as f64;
+        let t1 = t0 + step;
+        let (p0, p3) = (pt(t0), pt(t1));
+        let c1 = (p0.0 - k * rx * t0.sin(), p0.1 + k * ry * t0.cos());
+        let c2 = (p3.0 + k * rx * t1.sin(), p3.1 - k * ry * t1.cos());
+        ops.push(Op::C(c1, c2, p3));
+    }
+    ops
+}
+
+/// Consecutive subpaths: `counts[i]` points each, taken in order from `pts`. Counts that run past the
+/// point list are cut short rather than failing the whole record.
+pub(crate) fn subpaths(pts: &[P], counts: &[usize], close: bool) -> Vec<Op> {
+    let mut ops = Vec::with_capacity(pts.len() + counts.len());
+    let mut at = 0usize;
+    for &c in counts {
+        let end = at.saturating_add(c).min(pts.len());
+        let Some((first, rest)) = pts.get(at..end).and_then(|s| s.split_first()) else {
+            at = end;
+            continue;
+        };
+        ops.push(Op::M(*first));
+        ops.extend(rest.iter().map(|p| Op::L(*p)));
+        if close {
+            ops.push(Op::Z);
+        }
+        at = end;
+    }
+    ops
+}

crates/metafile/src/lib.rs

@@ -0,0 +1,208 @@
+//! DeckCraft metafiles (ported from WordCraft's `crates/metafile`): reads Windows Metafiles (WMF)
+//! and Enhanced Metafiles (EMF) into a neutral vector model of filled and stroked paths and RGBA
+//! bitmaps, in a picture frame with y down.
+//!
+//! The reader is pure Rust over byte slices (no file system), so it builds for wasm. Every read is
+//! bounds-checked and every count is capped; hostile input yields a shorter picture or an [`Error`],
+//! never a panic.
+//!
+//! Records follow MS-WMF and MS-EMF. Records outside the supported set are skipped silently.
+#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
+#![forbid(unsafe_code)]
+
+mod bytes;
+mod canvas;
+mod dib;
+mod emf;
+mod geom;
+mod place;
+mod wmf;
+
+#[cfg(test)]
+mod tests;
+
+use bytes::Bytes;
+use canvas::Raw;
+use geom::{Op, P};
+pub use place::{MAX_BITMAP_SIDE, PlacedItem};
+
+/// Items kept from one file. Past the cap the parse stops and keeps what it has.
+pub(crate) const MAX_ITEMS: usize = 200_000;
+/// Object table slots (WMF handles, EMF object indices).
+pub(crate) const MAX_OBJECTS: usize = 4096;
+/// Largest bitmap in pixels (about 40 megapixels, 160 MB of RGBA).
+pub(crate) const MAX_PIXELS: usize = 40_000_000;
+/// DC save-stack depth.
+pub(crate) const MAX_STACK: usize = 1024;
+/// Points in one open path bracket.
+pub(crate) const MAX_PATH_OPS: usize = 2_000_000;
+/// Bytes of path ops and pixels kept from one file (about 256 MB).
+pub(crate) const MAX_BYTES: usize = 256 * 1024 * 1024;
+
+/// A parsed metafile. Items use coordinates in `0..width` and `0..height`, y down.
+#[derive(Debug, Clone, PartialEq)]
+pub struct Picture {
+    /// Size of the drawing in its own units: points for placeable WMF and EMF (from the frame), device
+    /// or logical units otherwise.
+    pub width: f32,
+    pub height: f32,
+    pub items: Vec<Item>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Item {
+    /// A filled and/or stroked path, in picture coordinates.
+    Path {
+        segs: Vec<Seg>,
+        fill: Option<[u8; 4]>,
+        /// Colour and width in picture units.
+        stroke: Option<([u8; 4], f32)>,
+        even_odd: bool,
+    },
+    /// A bitmap stretched into `rect` = `[x, y, w, h]` (picture units), RGBA8 rows top-down.
+    Bitmap { rect: [f32; 4], width: u32, height: u32, rgba: Vec<u8> },
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum Seg {
+    Move(f32, f32),
+    Line(f32, f32),
+    Cubic(f32, f32, f32, f32, f32, f32),
+    Close,
+}
+
+#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq)]
+pub enum Error {
+    #[error("not a WMF or EMF file")]
+    NotMetafile,
+    #[error("metafile header is truncated or invalid")]
+    BadHeader,
+    #[error("metafile has no readable records")]
+    NoRecords,
+}
+
+/// The picture frame in device units (`rect` = `[x, y, w, h]`) and, when the file states one, its
+/// size in picture units.
+pub(crate) struct Frame {
+    pub rect: [f64; 4],
+    pub size: Option<(f64, f64)>,
+}
+
+/// Parses a WMF (placeable or plain) or EMF file.
+pub fn parse(bytes: &[u8]) -> Result<Picture, Error> {
+    let b = Bytes(bytes);
+    let (cv, frame) = if emf::is_emf(b) {
+        emf::parse(b)?
+    } else if wmf::is_wmf(b) {
+        wmf::parse(b)?
+    } else {
+        return Err(Error::NotMetafile);
+    };
+    Ok(build(cv.items, frame))
+}
+
+/// True when the bytes start like a WMF (placeable or plain header) or an EMF.
+pub fn is_metafile(bytes: &[u8]) -> bool {
+    let b = Bytes(bytes);
+    emf::is_emf(b) || wmf::is_wmf(b)
+}
+
+/// Maps device-space output into the picture frame. Without a usable frame the frame is the bounding
+/// box of the drawing, so the origin is still the top-left of what was drawn.
+fn build(raw: Vec<Raw>, frame: Option<Frame>) -> Picture {
+    let frame = frame.filter(|f| f.rect.iter().all(|v| v.is_finite()) && f.rect[2] > 0.0 && f.rect[3] > 0.0);
+    let (rect, size) = match frame {
+        Some(f) => (f.rect, f.size.unwrap_or((f.rect[2], f.rect[3]))),
+        None => match bbox(&raw) {
+            Some([x0, y0, x1, y1]) => ([x0, y0, x1 - x0, y1 - y0], (x1 - x0, y1 - y0)),
+            None => return Picture { width: 0.0, height: 0.0, items: Vec::new() },
+        },
+    };
+    let sx = if rect[2] > 0.0 { size.0 / rect[2] } else { 1.0 };
+    let sy = if rect[3] > 0.0 { size.1 / rect[3] } else { 1.0 };
+    let tf = move |p: P| ((p.0 - rect[0]) * sx, (p.1 - rect[1]) * sy);
+    let stroke_scale = (sx + sy) / 2.0;
+    // No stroke is wider than the picture's diagonal: anything wider is a mapping artefact.
+    let diag = size.0.hypot(size.1);
+    let items = raw.into_iter().filter_map(|r| match r {
+        Raw::Path { ops, fill, stroke, even_odd } => {
+            let segs = ops.iter().map(|op| seg(op, tf)).collect::<Option<Vec<Seg>>>()?;
+            if segs.len() < 2 {
+                return None;
+            }
+            let stroke = stroke.and_then(|(c, w)| Some((c, f((w * stroke_scale).min(diag))?)));
+            Some(Item::Path { segs, fill, stroke, even_odd })
+        }
+        Raw::Bitmap { rect: r, img } => {
+            let (x, y) = tf((r[0], r[1]));
+            let rect = [f(x)?, f(y)?, f(r[2] * sx)?, f(r[3] * sy)?];
+            Some(Item::Bitmap { rect, width: img.w as u32, height: img.h as u32, rgba: img.px })
+        }
+    });
+    let items = items.collect();
+    Picture { width: f(size.0).unwrap_or(0.0), height: f(size.1).unwrap_or(0.0), items }
+}
+
+fn f(v: f64) -> Option<f32> {
+    let v = v as f32;
+    v.is_finite().then_some(v)
+}
+
+fn seg(op: &Op, tf: impl Fn(P) -> P) -> Option<Seg> {
+    let pt = |p: P| {
+        let (x, y) = tf(p);
+        Some((f(x)?, f(y)?))
+    };
+    Some(match *op {
+        Op::M(p) => {
+            let (x, y) = pt(p)?;
+            Seg::Move(x, y)
+        }
+        Op::L(p) => {
+            let (x, y) = pt(p)?;
+            Seg::Line(x, y)
+        }
+        Op::C(a, b, c) => {
+            let (x1, y1) = pt(a)?;
+            let (x2, y2) = pt(b)?;
+            let (x3, y3) = pt(c)?;
+            Seg::Cubic(x1, y1, x2, y2, x3, y3)
+        }
+        Op::Z => Seg::Close,
+    })
+}
+
+/// Bounding box `[x0, y0, x1, y1]` over the finite points of the output.
+fn bbox(raw: &[Raw]) -> Option<[f64; 4]> {
+    let mut b: Option<[f64; 4]> = None;
+    let mut grow = |p: P| {
+        if p.0.is_finite() && p.1.is_finite() {
+            b = Some(match b {
+                None => [p.0, p.1, p.0, p.1],
+                Some([x0, y0, x1, y1]) => [x0.min(p.0), y0.min(p.1), x1.max(p.0), y1.max(p.1)],
+            });
+        }
+    };
+    for r in raw {
+        match r {
+            Raw::Path { ops, .. } => {
+                for op in ops {
+                    match *op {
+                        Op::M(p) | Op::L(p) => grow(p),
+                        Op::C(a, c, d) => {
+                            grow(a);
+                            grow(c);
+                            grow(d);
+                        }
+                        Op::Z => {}
+                    }
+                }
+            }
+            Raw::Bitmap { rect, .. } => {
+                grow((rect[0], rect[1]));
+                grow((rect[0] + rect[2], rect[1] + rect[3]));
+            }
+        }
+    }
+    b
+}

crates/metafile/src/place.rs

@@ -0,0 +1,124 @@
+//! Placing a picture on a target (a page or a device): the fitted transform, paths as kurbo paths in
+//! target units and bitmaps as target rectangles. The rasteriser and the PDF writer only paint the result.
+
+use kurbo::{Affine, BezPath, Rect, Shape};
+
+use crate::{Item, Picture, Seg};
+
+/// Largest bitmap side the renderers draw: within the PDF image limit and the rasteriser's 16-bit sides.
+pub const MAX_BITMAP_SIDE: u32 = 30_000;
+/// Placed coordinates past this (target units) are far off any page; such items are left out.
+const MAX_COORD: f64 = 1e6;
+/// Smallest placed bitmap side (target units), so the stretch onto it is never singular.
+const MIN_BITMAP_SIDE: f64 = 1e-6;
+
+/// One item of a placed picture, in target units.
+pub enum PlacedItem {
+    /// A filled and/or stroked path. The stroke width is in target units; 0 is a cosmetic hairline that
+    /// the renderer draws at its minimum width.
+    Path { path: BezPath, fill: Option<[u8; 4]>, stroke: Option<([u8; 4], f64)>, even_odd: bool },
+    /// `Picture::items[index]`, a bitmap, stretched into `rect`.
+    Bitmap { index: usize, rect: Rect },
+}
+
+impl Picture {
+    /// Whether the picture has a finite, positive size, so it can be fitted into a frame.
+    pub fn has_size(&self) -> bool {
+        self.width.is_finite() && self.height.is_finite() && self.width > 0.0 && self.height > 0.0
+    }
+
+    /// The transform that fits the picture into `r` with the crop fractions `crop` (left, top, right,
+    /// bottom) removed first: the visible part fills `r`. None for a degenerate size.
+    pub fn fit(&self, r: Rect, crop: [f32; 4]) -> Option<Affine> {
+        let [cl, ct, cr, cb] = crop.map(|v| if v.is_finite() { f64::from(v.clamp(0.0, 0.95)) } else { 0.0 });
+        let (w, h) = (f64::from(self.width), f64::from(self.height));
+        let sx = r.width() / (w * (1.0 - cl - cr).max(0.05));
+        let sy = r.height() / (h * (1.0 - ct - cb).max(0.05));
+        (sx.is_finite() && sy.is_finite() && sx > 0.0 && sy > 0.0)
+            .then(|| Affine::translate((r.x0 - cl * w * sx, r.y0 - ct * h * sy)) * Affine::scale_non_uniform(sx, sy))
+    }
+
+    /// The items placed into `r` with `crop` applied. Items that are not finite or reach past ±1e6
+    /// target units are left out (they are far off any page), as are bitmaps with no area. Stroke
+    /// widths are scaled to target units (along the mean axis scale, so a non-uniform fit keeps
+    /// strokes even).
+    pub fn place(&self, r: Rect, crop: [f32; 4]) -> Vec<PlacedItem> {
+        let Some(tf) = self.fit(r, crop) else { return Vec::new() };
+        let c = tf.as_coeffs();
+        let k = (c[0].abs() + c[3].abs()) / 2.0;
+        let mut out = Vec::with_capacity(self.items.len());
+        for (index, item) in self.items.iter().enumerate() {
+            match item {
+                Item::Path { segs, fill, stroke, even_odd } => {
+                    let path = tf * bez(segs);
+                    if in_range(path.bounding_box()) {
+                        let stroke = stroke.map(|(c, w)| (c, f64::from(w) * k));
+                        out.push(PlacedItem::Path { path, fill: *fill, stroke, even_odd: *even_odd });
+                    }
+                }
+                Item::Bitmap { rect: [x, y, w, h], .. } => {
+                    let (x0, y0) = (f64::from(*x), f64::from(*y));
+                    let rect = tf.transform_rect_bbox(Rect::new(x0, y0, x0 + f64::from(*w), y0 + f64::from(*h)));
+                    if in_range(rect) && rect.width() > MIN_BITMAP_SIDE && rect.height() > MIN_BITMAP_SIDE {
+                        out.push(PlacedItem::Bitmap { index, rect });
+                    }
+                }
+            }
+        }
+        out
+    }
+}
+
+impl Item {
+    /// Takes a bitmap's pixels out of the item (its geometry stays) and returns them as (width, height,
+    /// RGBA) when a renderer can draw them: both sides in 1..=[`MAX_BITMAP_SIDE`] and exactly that many
+    /// pixels. None for paths and for bitmaps that cannot be drawn.
+    pub fn take_pixels(&mut self) -> Option<(u32, u32, Vec<u8>)> {
+        let Item::Bitmap { width, height, rgba, .. } = self else { return None };
+        let (w, h, px) = (*width, *height, std::mem::take(rgba));
+        let sides = (1..=MAX_BITMAP_SIDE).contains(&w) && (1..=MAX_BITMAP_SIDE).contains(&h);
+        (sides && px.len() == (w as usize).saturating_mul(h as usize).saturating_mul(4)).then_some((w, h, px))
+    }
+}
+
+/// Segments as a kurbo path. A segment after a close opens a new subpath at the last start point.
+fn bez(segs: &[Seg]) -> BezPath {
+    let mut p = BezPath::new();
+    let mut start = (0.0, 0.0);
+    let mut open = false;
+    for s in segs {
+        match *s {
+            Seg::Move(x, y) => {
+                start = (f64::from(x), f64::from(y));
+                p.move_to(start);
+                open = true;
+            }
+            Seg::Line(x, y) => {
+                if !open {
+                    p.move_to(start);
+                }
+                p.line_to((f64::from(x), f64::from(y)));
+                open = true;
+            }
+            Seg::Cubic(a, b, c, d, e, f) => {
+                if !open {
+                    p.move_to(start);
+                }
+                p.curve_to((f64::from(a), f64::from(b)), (f64::from(c), f64::from(d)), (f64::from(e), f64::from(f)));
+                open = true;
+            }
+            Seg::Close => {
+                if open {
+                    p.close_path();
+                }
+                open = false;
+            }
+        }
+    }
+    p
+}
+
+/// Whether a placed box is finite and within ±[`MAX_COORD`].
+fn in_range(b: Rect) -> bool {
+    [b.x0, b.y0, b.x1, b.y1].iter().all(|v| v.is_finite() && v.abs() < MAX_COORD)
+}

crates/metafile/src/wmf.rs

@@ -0,0 +1,273 @@
+//! WMF reader (MS-WMF). A file is an optional 22-byte placeable header, a 9-word standard header, then
+//! records of (size in 16-bit words, function, parameters). Parameters are read at byte 6 of each record.
+
+use crate::bytes::Bytes;
+use crate::canvas::{Brush, Canvas, Obj, Pen, colorref};
+use crate::dib;
+use crate::geom::{self, ArcKind, P};
+use crate::{Error, Frame, MAX_PATH_OPS};
+
+const PLACEABLE_KEY: u32 = 0x9AC6_CDD7;
+const DEFAULT_INCH: f64 = 1440.0;
+
+pub(crate) fn is_wmf(b: Bytes) -> bool {
+    if b.u32(0) == Some(PLACEABLE_KEY) {
+        return true;
+    }
+    matches!(b.u16(0), Some(1 | 2)) && b.u16(2) == Some(9) && matches!(b.u16(4), Some(0x100 | 0x300))
+}
+
+/// Reads all records. Returns the drawing state and the picture frame, or an error when no record
+/// could be read at all.
+pub(crate) fn parse(input: Bytes) -> Result<(Canvas, Option<Frame>), Error> {
+    let placeable = input.u32(0) == Some(PLACEABLE_KEY);
+    // Placeable bounds: logical corners (left, top, right, bottom) and their size in points.
+    let (hdr, bounds) = if placeable {
+        let [l, t, r, b] = [6, 8, 10, 12].map(|o| input.i16(o).map(f64::from));
+        let (Some(l), Some(t), Some(r), Some(b)) = (l, t, r, b) else { return Err(Error::BadHeader) };
+        let inch = input.u16(14).filter(|v| *v > 0).map_or(DEFAULT_INCH, f64::from);
+        let (w, h) = (r - l, b - t);
+        let bounds = (w > 0.0 && h > 0.0).then_some(([l, t, r, b], (w * 72.0 / inch, h * 72.0 / inch)));
+        (22, bounds)
+    } else {
+        (0, None)
+    };
+    let hsize = input.u16(hdr + 2).ok_or(Error::BadHeader)? as usize;
+    if hsize < 9 {
+        return Err(Error::BadHeader);
+    }
+    let mut pos = hdr.checked_add(hsize.checked_mul(2).ok_or(Error::BadHeader)?).ok_or(Error::BadHeader)?;
+    // Played into a target like Word does: the placeable bounds are the first window, the target (the
+    // picture size) the viewport. A plain WMF's target is its first window.
+    let mut cv = Canvas::new();
+    if let Some((c, size)) = bounds {
+        cv.play_into(Some([c[0], c[1], c[2] - c[0], c[3] - c[1]]), size);
+    }
+    let mut player_viewport = bounds.is_some();
+    let mut parsed = 0usize;
+    while !cv.full() {
+        let (Some(words), Some(func)) = (input.u32(pos), pos.checked_add(4).and_then(|o| input.u16(o))) else { break };
+        let Some(len) = (words as usize).checked_mul(2).filter(|l| *l >= 6) else { break };
+        let Some(rec) = input.slice(pos, len) else { break };
+        if func == 0 {
+            break;
+        }
+        record(&mut cv, func, Bytes(rec));
+        if func == 0x020C && cv.window_set && !player_viewport && !cv.viewport_set {
+            let we = cv.map.window_ext();
+            cv.play_into(None, (we.0.abs(), we.1.abs()));
+            player_viewport = true;
+        }
+        parsed += 1;
+        let Some(next) = pos.checked_add(len) else { break };
+        pos = next;
+    }
+    if parsed == 0 {
+        return Err(Error::NoRecords);
+    }
+    let frame = match bounds {
+        // Played into its target: the frame is the target.
+        Some((_, size)) if !cv.viewport_set && cv.map.uses_extents() => Some(Frame { rect: [0.0, 0.0, size.0, size.1], size: Some(size) }),
+        // The file set its own viewport, so the drawing is in its device units and the logical bounds
+        // go through the final mapping.
+        Some((c, size)) => {
+            let (a, b) = (cv.map.device((c[0], c[1])), cv.map.device((c[2], c[3])));
+            let rect = [a.0.min(b.0), a.1.min(b.1), (b.0 - a.0).abs(), (b.1 - a.1).abs()];
+            (rect[2] > 0.0 && rect[3] > 0.0).then_some(Frame { rect, size: Some(size) })
+        }
+        None if player_viewport && !cv.viewport_set && cv.map.uses_extents() => {
+            let ve = cv.map.viewport_ext();
+            Some(Frame { rect: [0.0, 0.0, ve.0, ve.1], size: None })
+        }
+        None if cv.window_set => Some(Frame { rect: cv.map.window_rect(), size: None }),
+        None => None,
+    };
+    Ok((cv, frame))
+}
+
+fn record(cv: &mut Canvas, func: u16, r: Bytes) {
+    if cv.full() {
+        return;
+    }
+    let _ = match func {
+        0x0103 => r.u16(6).map(|m| cv.set_map_mode(u32::from(m))),
+        0x0106 => r.u16(6).map(|m| cv.set_polyfill(u32::from(m))),
+        0x0104 => r.u16(6).map(|m| cv.set_rop2(u32::from(m))),
+        // Y is stored before X in these records.
+        0x020B => xy16(r, 6).map(|p| cv.set_window_org(p)),
+        0x020C => xy16(r, 6).map(|p| cv.set_window_ext(p)),
+        0x020D => xy16(r, 6).map(|p| cv.set_viewport_org(p)),
+        0x020E => xy16(r, 6).map(|p| cv.set_viewport_ext(p)),
+        0x001E => {
+            cv.save_dc();
+            Some(())
+        }
+        0x0127 => r.i16(6).map(|n| cv.restore_dc(i32::from(n))),
+        0x0214 => xy16(r, 6).map(|p| cv.move_to(p)),
+        0x0213 => xy16(r, 6).map(|p| cv.line_to(p)),
+        0x0325 => counted_points(r).map(|pts| cv.poly(&pts, false, false, true)),
+        0x0324 => counted_points(r).map(|pts| cv.poly(&pts, true, true, true)),
+        0x0538 => polypolygon(r).map(|ops| cv.shape(&ops, true, true)),
+        0x041B => rect16(r, 6).map(|[l, t, rr, b]| cv.shape(&geom::rect(l, t, rr, b), true, true)),
+        0x061C => {
+            let [ew, eh] = [r.i16(8), r.i16(6)];
+            let (Some(ew), Some(eh)) = (ew, eh) else { return };
+            rect16(r, 10).map(|[l, t, rr, b]| {
+                cv.shape(&geom::round_rect(l, t, rr, b, f64::from(ew), f64::from(eh)), true, true);
+            })
+        }
+        0x0418 => rect16(r, 6).map(|[l, t, rr, b]| cv.shape(&geom::ellipse(l, t, rr, b), true, true)),
+        0x0817 | 0x081A | 0x0830 => arc16(r).map(|(bounds, s, e)| {
+            let kind = match func {
+                0x0817 => ArcKind::Arc,
+                0x081A => ArcKind::Pie,
+                _ => ArcKind::Chord,
+            };
+            let [l, t, rr, b] = bounds;
+            cv.shape(&geom::arc_shape(l, t, rr, b, s, e, kind), kind != ArcKind::Arc, true);
+        }),
+        0x02FA => create_pen(cv, r),
+        0x02FC => create_brush(cv, r),
+        // Fonts, palettes, pattern brushes and regions take a handle slot too, so later SELECTOBJECT
+        // handles count them; selecting one draws nothing.
+        0x02FB | 0x00F7 | 0x01F9 | 0x0142 | 0x06FF => {
+            cv.add_object(None, Obj::Other);
+            Some(())
+        }
+        0x012D => r.u16(6).map(|h| cv.select(wmf_handle(h))),
+        0x01F0 => r.u16(6).map(|h| cv.delete_object(u32::from(h))),
+        // STRETCHDIB: rop(4) usage(2) srcH srcW ySrc xSrc destH destW yDest xDest, then the DIB.
+        0x0F43 => {
+            let rop = r.u32(6).unwrap_or(0);
+            dib_blit(cv, r, 28, rop, [i16s(r, 26), i16s(r, 24), i16s(r, 22), i16s(r, 20)], [i16s(r, 18), i16s(r, 16), i16s(r, 14), i16s(r, 12)])
+        }
+        0x0B41 => dib_stretchblt(cv, r),
+        0x0940 => dib_bitblt(cv, r),
+        _ => Some(()),
+    };
+}
+
+/// A 16-bit WMF handle as a canvas object index: stock objects are `0x8000 | index`, which the
+/// canvas reads with the 32-bit stock flag.
+fn wmf_handle(h: u16) -> u32 {
+    let h = u32::from(h);
+    if h & 0x8000 != 0 { (h & 0x7FFF) | 0x8000_0000 } else { h }
+}
+
+/// An i16 field as f64; 0 past the end.
+fn i16s(r: Bytes, off: usize) -> f64 {
+    r.i16(off).map_or(0.0, f64::from)
+}
+
+/// CREATEPENINDIRECT: style, width (x, y), colour. Only the width's x component is used.
+fn create_pen(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let style = r.u16(6)?;
+    let width = r.i16(8)?;
+    let color = r.u32(12)?;
+    cv.add_object(None, Obj::Pen(Pen { style: u32::from(style), width: f64::from(width), color: colorref(color) }));
+    Some(())
+}
+
+/// CREATEBRUSHINDIRECT: style, colour, hatch (hatch is not drawn).
+fn create_brush(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let style = r.u16(6)?;
+    let color = r.u32(8)?;
+    cv.add_object(None, Obj::Brush(Brush { style: u32::from(style), color: colorref(color) }));
+    Some(())
+}
+
+/// (x, y) from a Y-then-X pair stored at `off`.
+fn xy16(r: Bytes, off: usize) -> Option<P> {
+    Some((f64::from(r.i16(off + 2)?), f64::from(r.i16(off)?)))
+}
+
+/// Rectangle stored as bottom, right, top, left (the order MS-WMF uses for RECTANGLE and ELLIPSE).
+fn rect16(r: Bytes, off: usize) -> Option<[f64; 4]> {
+    let (b, rr, t, l) = (r.i16(off)?, r.i16(off + 2)?, r.i16(off + 4)?, r.i16(off + 6)?);
+    Some([f64::from(l), f64::from(t), f64::from(rr), f64::from(b)])
+}
+
+/// ARC, PIE and CHORD: end Y, end X, start Y, start X, then the bounding rectangle (bottom, right, top, left).
+fn arc16(r: Bytes) -> Option<([f64; 4], P, P)> {
+    let end = xy16(r, 6)?;
+    let start = xy16(r, 10)?;
+    let bounds = rect16(r, 14)?;
+    Some((bounds, start, end))
+}
+
+/// A count of 16-bit points, then the points (POLYLINE, POLYGON).
+fn counted_points(r: Bytes) -> Option<Vec<P>> {
+    let n = r.u16(6)? as usize;
+    r.tail(8)?.points(0, n, false)
+}
+
+/// POLYPOLYGON: polygon count, one 16-bit point count per polygon, then all points.
+fn polypolygon(r: Bytes) -> Option<Vec<geom::Op>> {
+    let n = r.u16(6)? as usize;
+    let mut counts = Vec::with_capacity(n);
+    for i in 0..n {
+        counts.push(r.u16(i.checked_mul(2)?.checked_add(8)?)? as usize);
+    }
+    let total = counts.iter().try_fold(0usize, |a, c| a.checked_add(*c))?;
+    if total > MAX_PATH_OPS {
+        return None;
+    }
+    let pts = r.tail(n.checked_mul(2)?.checked_add(8)?)?.points(0, total, false)?;
+    Some(geom::subpaths(&pts, &counts, true))
+}
+
+/// Whether a DIBBITBLT or DIBSTRETCHBLT record carries a bitmap: without one it is exactly
+/// `(function >> 8) + 3` words long (MS-WMF 2.3.1.2, 2.3.1.3).
+fn has_bitmap(func: u16, r: Bytes) -> bool {
+    r.0.len() / 2 > usize::from(func >> 8) + 3
+}
+
+/// META_DIBBITBLT: rop(4), ySrc, xSrc, then height, width, yDest, xDest and the DIB at 22. The
+/// bitmap-less form has a reserved word before the height, so its fields sit 2 bytes later; it, or
+/// a source-less raster operation, fills the destination.
+fn dib_bitblt(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let rop = r.u32(6)?;
+    if !has_bitmap(0x0940, r) {
+        cv.fill_rop([i16s(r, 22), i16s(r, 20), i16s(r, 18), i16s(r, 16)], rop);
+        return Some(());
+    }
+    let dst = [i16s(r, 20), i16s(r, 18), i16s(r, 16), i16s(r, 14)];
+    if Canvas::sourceless(rop) {
+        cv.fill_rop(dst, rop);
+        return Some(());
+    }
+    let src = [i16s(r, 12), i16s(r, 10), dst[2], dst[3]];
+    dib_blit(cv, r, 22, rop, dst, src)
+}
+
+/// META_DIBSTRETCHBLT: rop(4), srcH, srcW, ySrc, xSrc, then destH, destW, yDest, xDest and the DIB at
+/// 26. The bitmap-less form has a reserved word after xSrc, so the destination sits 2 bytes later;
+/// it, or a source-less raster operation, fills the destination.
+fn dib_stretchblt(cv: &mut Canvas, r: Bytes) -> Option<()> {
+    let rop = r.u32(6)?;
+    if !has_bitmap(0x0B41, r) {
+        cv.fill_rop([i16s(r, 26), i16s(r, 24), i16s(r, 22), i16s(r, 20)], rop);
+        return Some(());
+    }
+    let dst = [i16s(r, 24), i16s(r, 22), i16s(r, 20), i16s(r, 18)];
+    if Canvas::sourceless(rop) {
+        cv.fill_rop(dst, rop);
+        return Some(());
+    }
+    let src = [i16s(r, 16), i16s(r, 14), i16s(r, 12), i16s(r, 10)];
+    dib_blit(cv, r, 26, rop, dst, src)
+}
+
+/// A DIB at `at`, stretched from source rectangle `src` into `dst` (both in logical units, pixels for `src`).
+/// The raster operation `rop` decides how the pixels combine (see [`dib::prepare`]).
+fn dib_blit(cv: &mut Canvas, r: Bytes, at: usize, rop: u32, dst: [f64; 4], src: [f64; 4]) -> Option<()> {
+    let dib = r.tail(at)?;
+    let n = dib::info_len(dib)?;
+    let info = dib.slice(0, n)?;
+    let bits = dib.tail(n)?;
+    let mut img = dib::decode(Bytes(info), bits, false)?;
+    dib::prepare(&mut img, dib::Blend::Rop(rop));
+    let (img, dst) = dib::clip_blit(&img, src.map(|v| v as i64), dst)?;
+    cv.bitmap(dst, img);
+    Some(())
+}

crates/render/Cargo.toml

@@ -11,6 +11,7 @@ workspace = true
 [dependencies]
 deckcraft-geom = { workspace = true }
 deckcraft-color = { workspace = true }
+deckcraft-metafile = { workspace = true }
 deckcraft-model = { workspace = true }
 deckcraft-fonts = { workspace = true }
 deckcraft-text = { workspace = true }

crates/render/src/images.rs

@@ -99,11 +99,20 @@ fn duotone_rgb(a: &PictureAdjust) -> Option<(deckcraft_color::Rgba, deckcraft_co
     Some((rgb(d, deckcraft_color::Rgba::BLACK), rgb(l, deckcraft_color::Rgba::WHITE)))
 }
 
-/// Decode encoded bytes (PNG, JPEG, GIF, WebP, BMP, TIFF) to straight RGBA.
+/// Decode encoded bytes (PNG, JPEG, GIF, WebP, BMP, TIFF; WMF and EMF drawn at
+/// [`crate::metafile::DEFAULT_SIDE`]) to straight RGBA.
 pub fn decode(bytes: &[u8]) -> Option<image::RgbaImage> {
+    decode_at(bytes, crate::metafile::DEFAULT_SIDE)
+}
+
+/// [`decode`], with a metafile drawn with its longer side `side` px.
+fn decode_at(bytes: &[u8], side: u32) -> Option<image::RgbaImage> {
     if bytes.len() > 512 << 20 {
         return None;
     }
+    if crate::metafile::is_metafile(bytes) {
+        return crate::metafile::rasterize(bytes, side);
+    }
     let img = image::load_from_memory(bytes).ok()?;
     let (w, h) = (img.width(), img.height());
     if w == 0 || h == 0 || (w as u64) * (h as u64) > 400_000_000 {
@@ -131,13 +140,13 @@ pub fn decode_for(bytes: &Arc<Vec<u8>>, want: f64, adj: &PictureAdjust) -> Optio
     }) {
         return Some(pm);
     }
-    let Some(mut img) = decode(bytes) else {
+    let target = 1u32 << bucket;
+    let Some(mut img) = decode_at(bytes, target) else {
         with(|c| {
             c.bad.insert(addr, bytes.clone());
         });
         return None;
     };
-    let target = 1u32 << bucket;
     let (w, h) = img.dimensions();
     if w.max(h) > target.max(16) && w.max(h) > 4096.min(target * 2) {
         let k = target as f64 / w.max(h) as f64;

crates/render/src/lib.rs

@@ -12,6 +12,7 @@ mod colr;
 
 mod compound;
 mod images;
+mod metafile;
 mod morph_path;
 mod morph_text;
 mod paint;

crates/render/src/metafile.rs

@@ -0,0 +1,105 @@
+//! Windows Metafile and Enhanced Metafile pictures (`image/x-wmf`, `image/x-emf`): parsed by
+//! `deckcraft-metafile` and drawn as vectors into a bitmap of the size the slide needs, so they go
+//! through the same crop, tile and recolour path as any other picture.
+
+use std::sync::Arc;
+
+use deckcraft_metafile::PlacedItem;
+use kurbo::{Affine, Rect, Shape as _};
+use vello_cpu::{Pixmap, RenderContext, Resources, peniko};
+
+/// Longest side of a metafile drawn without a target size (export, thumbnails of the picture).
+pub const DEFAULT_SIDE: u32 = 1024;
+/// Largest side drawn.
+const MAX_SIDE: u32 = 8192;
+
+/// Is `bytes` a WMF or EMF file?
+pub fn is_metafile(bytes: &[u8]) -> bool {
+    deckcraft_metafile::is_metafile(bytes)
+}
+
+/// Draw the metafile `bytes` into straight RGBA with its longer side `side` px (transparent where
+/// it draws nothing). `None` when it doesn't parse or has no size.
+pub fn rasterize(bytes: &[u8], side: u32) -> Option<image::RgbaImage> {
+    let mut pic = deckcraft_metafile::parse(bytes).ok()?;
+    if !pic.has_size() {
+        return None;
+    }
+    let side = side.clamp(16, MAX_SIDE) as f64;
+    let (pw, ph) = (pic.width as f64, pic.height as f64);
+    let k = side / pw.max(ph);
+    let w = (pw * k).round().clamp(1.0, MAX_SIDE as f64) as u16;
+    let h = (ph * k).round().clamp(1.0, MAX_SIDE as f64) as u16;
+    let pixmaps: Vec<Option<Arc<Pixmap>>> = pic.items.iter_mut().map(|it| it.take_pixels().and_then(|(w, h, px)| premul(w, h, &px))).collect();
+    let mut ctx = RenderContext::new_with(w, h, vello_cpu::RenderSettings { num_threads: 0, ..Default::default() });
+    let r = Rect::new(0.0, 0.0, w as f64, h as f64);
+    ctx.push_clip_layer(&r.to_path(0.1));
+    for it in pic.place(r, [0.0; 4]) {
+        match it {
+            PlacedItem::Path { path, fill, stroke, even_odd } => {
+                if let Some(f) = fill {
+                    ctx.set_paint(rgba(f));
+                    ctx.set_fill_rule(if even_odd { peniko::Fill::EvenOdd } else { peniko::Fill::NonZero });
+                    ctx.fill_path(&path);
+                }
+                // GDI pens: round caps and joins; a cosmetic (zero-width) pen is one pixel.
+                if let Some((s, sw)) = stroke {
+                    ctx.set_paint(rgba(s));
+                    ctx.set_stroke(kurbo::Stroke::new(sw.max(1.0)).with_caps(kurbo::Cap::Round).with_join(kurbo::Join::Round));
+                    ctx.stroke_path(&path);
+                }
+            }
+            PlacedItem::Bitmap { index, rect } => {
+                let Some(Some(pm)) = pixmaps.get(index) else { continue };
+                let (bw, bh) = (pm.width().max(1) as f64, pm.height().max(1) as f64);
+                ctx.set_paint(vello_cpu::Image {
+                    image: vello_cpu::ImageSource::Pixmap(pm.clone()),
+                    sampler: peniko::ImageSampler::default().with_quality(peniko::ImageQuality::Medium),
+                });
+                ctx.set_paint_transform(Affine::translate((rect.x0, rect.y0)) * Affine::scale_non_uniform(rect.width() / bw, rect.height() / bh));
+                ctx.fill_rect(&rect);
+                ctx.reset_paint_transform();
+            }
+        }
+    }
+    ctx.set_fill_rule(peniko::Fill::NonZero);
+    ctx.pop_layer();
+    ctx.flush();
+    let mut px = vec![0u8; w as usize * h as usize * 4];
+    if let Some(pm) = vello_cpu::PixmapMut::new(w, h, &mut px) {
+        ctx.render(pm, &mut Resources::new());
+    }
+    // Premultiplied to straight.
+    for p in px.as_chunks_mut::<4>().0 {
+        let a = p[3] as u32;
+        if a != 0 && a != 255 {
+            for c in p.iter_mut().take(3) {
+                *c = ((*c as u32 * 255 + a / 2) / a).min(255) as u8;
+            }
+        }
+    }
+    image::RgbaImage::from_raw(w as u32, h as u32, px)
+}
+
+fn rgba(c: [u8; 4]) -> peniko::Color {
+    peniko::Color::from_rgba8(c[0], c[1], c[2], c[3])
+}
+
+/// Straight RGBA rows to a premultiplied pixmap.
+fn premul(w: u32, h: u32, px: &[u8]) -> Option<Arc<Pixmap>> {
+    if w == 0 || h == 0 || w > u16::MAX as u32 || h > u16::MAX as u32 || px.len() < w as usize * h as usize * 4 {
+        return None;
+    }
+    let data = px
+        .as_chunks::<4>()
+        .0
+        .iter()
+        .take(w as usize * h as usize)
+        .map(|p| {
+            let a = p[3] as u16;
+            let m = |c: u8| ((c as u16 * a + 127) / 255) as u8;
+            vello_cpu::color::PremulRgba8 { r: m(p[0]), g: m(p[1]), b: m(p[2]), a: p[3] }
+        })
+        .collect();
+    Some(Arc::new(Pixmap::from_parts(data, w as u16, h as u16)))
+}

crates/render/src/tests.rs

@@ -1037,7 +1037,8 @@ fn wordart_arch_up_lifts_the_middle_of_the_line() {
     // at the box top and the ends sit clearly lower.
     let (al, am, ar) = (top_near(&atops, ax0 + 20).unwrap(), top_near(&atops, (ax0 + ax1) / 2).unwrap(), top_near(&atops, ax1 - 20).unwrap());
     assert!(al > am + 10 && ar > am + 10, "arched {al} {am} {ar}");
-    assert!((80..=110).contains(&ay0), "arch top {ay0}");
+    // At the box top (y = 100), give or take the font: Linux's fallback face reaches 79.
+    assert!((70..=110).contains(&ay0), "arch top {ay0}");
 }
 
 #[test]
@@ -1075,3 +1076,73 @@ fn every_warp_preset_renders_text_inside_the_slide() {
         assert!(x0 <= x1 && y0 <= y1, "{name}: no ink");
     }
 }
+
+/// A placeable WMF, 2 × 1 inch (2880 × 1440 twips): a solid red brush and a rectangle over the
+/// left half, nothing on the right.
+fn half_red_wmf() -> Vec<u8> {
+    fn rec(func: u16, params: &[i16]) -> Vec<u8> {
+        let mut v = ((3 + params.len()) as u32).to_le_bytes().to_vec();
+        v.extend(func.to_le_bytes());
+        for p in params {
+            v.extend(p.to_le_bytes());
+        }
+        v
+    }
+    // CREATEBRUSHINDIRECT (solid, COLORREF 0x000000FF = red), SELECTOBJECT 0, RECTANGLE (bottom,
+    // right, top, left).
+    let body = [rec(0x02FC, &[0, 0xFF, 0, 0]), rec(0x012D, &[0]), rec(0x041B, &[1440, 1440, 0, 0]), rec(0, &[])].concat();
+    let mut f = 0x9AC6_CDD7u32.to_le_bytes().to_vec();
+    f.extend(0u16.to_le_bytes());
+    for v in [0i16, 0, 2880, 1440] {
+        f.extend(v.to_le_bytes());
+    }
+    f.extend(1440u16.to_le_bytes());
+    f.extend(0u32.to_le_bytes());
+    f.extend(0u16.to_le_bytes());
+    let total = (f.len() + 18 + body.len()) / 2;
+    for v in [1u16, 9, 0x300] {
+        f.extend(v.to_le_bytes());
+    }
+    f.extend((total as u32).to_le_bytes());
+    f.extend(16u16.to_le_bytes());
+    f.extend(0u32.to_le_bytes());
+    f.extend(0u16.to_le_bytes());
+    f.extend(body);
+    f
+}
+
+#[test]
+fn metafile_pictures_draw_their_vectors() {
+    let mut p = Presentation::default();
+    let media = p.add_media("image1.wmf", "image/x-wmf", half_red_wmf());
+    let fill = deckcraft_model::style::PictureFill { media, ..Default::default() };
+    let sh = Shape { id: ShapeId(600), xfrm: Some(Xfrm::new(100.0, 100.0, 400.0, 200.0)), kind: ShapeKind::Picture { fill }, ..Default::default() };
+    std::sync::Arc::make_mut(&mut p.slides[0]).shapes = vec![sh];
+    for scale in [0.5, 1.0, 3.0] {
+        let img = render_slide(&p, 0, &RenderOpts { scale, ..Default::default() });
+        let at = |x: f64, y: f64| img.pixel((x * scale) as u32, (y * scale) as u32);
+        let left = at(200.0, 200.0);
+        assert!(left[0] > 200 && left[1] < 60 && left[2] < 60, "left half red at {scale}: {left:?}");
+        let right = at(400.0, 200.0);
+        assert!(right[0] > 200 && right[1] > 200 && right[2] > 200, "right half empty at {scale}: {right:?}");
+    }
+}
+
+#[test]
+fn broken_metafiles_draw_nothing_and_never_panic() {
+    let wmf = half_red_wmf();
+    let mut cases: Vec<Vec<u8>> = (0..wmf.len()).step_by(3).map(|n| wmf[..n].to_vec()).collect();
+    cases.push(vec![1, 0, 0, 0, 0xFF, 0xFF, 0xFF, 0xFF]);
+    let mut huge = wmf.clone();
+    huge[10] = 0xFF;
+    huge[11] = 0x7F;
+    cases.push(huge);
+    for bytes in cases {
+        let mut p = Presentation::default();
+        let media = p.add_media("image1.emf", "image/x-emf", bytes);
+        let fill = deckcraft_model::style::PictureFill { media, ..Default::default() };
+        let sh = Shape { id: ShapeId(600), xfrm: Some(Xfrm::new(0.0, 0.0, 400.0, 200.0)), kind: ShapeKind::Picture { fill }, ..Default::default() };
+        std::sync::Arc::make_mut(&mut p.slides[0]).shapes = vec![sh];
+        let _ = render_slide(&p, 0, &RenderOpts { scale: 0.25, ..Default::default() });
+    }
+}

crates/text/src/lib.rs

@@ -261,7 +261,7 @@ fn make_style(ctx: &Ctx, r: &RunProps, scale: f64, prompt: Option<Rgba>) -> Styl
     let family = resolve::font_family(ctx, r);
     let bold = r.bold.unwrap_or(false);
     let italic = r.italic.unwrap_or(false);
-    let face = FontDb::global().face(&family, style_name(bold, italic));
+    let face = FontDb::global().document_face(&family, style_name(bold, italic));
     let fake_bold = bold && face.weight < 550.0;
     let fake_italic = italic && !face.italic;
     let size = (r.size.unwrap_or(18.0) * scale).clamp(0.5, 4000.0);

crates/ui-egui/src/lib.rs

@@ -22,6 +22,7 @@ pub mod status;
 pub mod textures;
 pub mod theme;
 pub mod thumbs;
+pub mod toast;
 pub mod widgets;
 
 use std::sync::mpsc::{Receiver, Sender};
@@ -181,6 +182,10 @@ pub struct SlideApp {
     /// Audio/video playback (editor control bar, slide show, `media.*` commands).
     pub media: media::MediaHost,
     pub status: Option<(String, f64)>,
+    /// A brief notice over the bottom of the window (missing fonts on opening a file).
+    pub toast: Option<toast::Toast>,
+    /// Documents (by uid) whose missing fonts have been mentioned.
+    fonts_noted: std::collections::HashSet<u64>,
     pub perf: Perf,
     /// Synthetic input events (control channel `ui.click` etc.), injected one per frame.
     pub synthetic: Vec<egui::Event>,
@@ -224,6 +229,8 @@ impl SlideApp {
             show: None,
             media: media::MediaHost::new(audio_out),
             status: None,
+            toast: None,
+            fonts_noted: Default::default(),
             perf: Perf { frame_ms: 0.0, render_ms: 0.0, fps: 0.0 },
             synthetic: vec![],
             canvas_rect: None,
@@ -730,6 +737,8 @@ impl SlideApp {
                 }
             }
         });
+        toast::note_missing_fonts(self);
+        toast::show(self, &ctx);
         dialogs::show(self, &ctx);
         menus::palette(self, &ctx);
         for url in std::mem::take(&mut self.pending_urls) {
@@ -889,6 +898,37 @@ mod tests {
         sh.text.as_ref().map(|t| t.paragraphs.iter().map(|p| p.text()).collect::<Vec<_>>().join("\n")).unwrap_or_default()
     }
 
+    #[test]
+    fn opening_a_file_with_missing_fonts_shows_a_toast_once() {
+        use egui_kittest::kittest::Queryable;
+        let mut p = deckcraft_model::Presentation::default();
+        let slide = std::sync::Arc::make_mut(&mut p.slides[0]);
+        let mut body = deckcraft_model::text::TextBody::from_text("Hello");
+        body.paragraphs[0].runs[0].props.font = Some("Qqq Nonexistent Sans".into());
+        slide.shapes[0].text = Some(body);
+        let data = deckcraft_engine::cmd::base64_encode(&deckcraft_engine::cmd::file::save_bytes(&p, "pptx").unwrap());
+        let mut harness = egui_kittest::Harness::builder().with_size(egui::vec2(1200.0, 800.0)).build_ui_state(
+            |ui, app: &mut SlideApp| {
+                app.logic(ui.ctx());
+                app.ui(ui);
+            },
+            SlideApp::new(Session::with_new(), Services::default()),
+        );
+        harness.run_steps(2);
+        assert!(harness.state().toast.is_none(), "a new presentation has nothing to say");
+        harness.state_mut().session.execute("file.openBytes", &json!({"name": "a.pptx", "data": data})).unwrap();
+        harness.run_steps(2);
+        let text = harness.state().toast.as_ref().map(|t| t.text.clone()).unwrap_or_default();
+        assert!(text.starts_with("Qqq Nonexistent Sans isn't installed"), "{text}");
+        assert!(harness.query_by_label_contains("Qqq Nonexistent Sans isn't installed").is_some());
+        // Closed, it stays closed for that document.
+        harness.get_by_label("Close").click();
+        harness.run_steps(2);
+        assert!(harness.state().toast.is_none());
+        harness.run_steps(2);
+        assert!(harness.state().toast.is_none());
+    }
+
     /// #17: Home created a new blank presentation instead of going to the start screen.
     #[test]
     fn home_shows_the_start_screen_over_the_open_presentation() {

crates/ui-egui/src/toast.rs

@@ -0,0 +1,94 @@
+//! Brief notices over the window's bottom edge: shown once, gone after a few seconds or when
+//! closed. Used to say a presentation's fonts aren't installed when it is first opened.
+
+use egui::{Align2, CornerRadius, Margin, Stroke, vec2};
+
+use crate::SlideApp;
+use crate::icons::{self, Icon};
+use crate::theme::{self, Tokens};
+
+/// How long a toast stays, in milliseconds.
+const SHOW_MS: f64 = 8000.0;
+
+pub struct Toast {
+    pub text: String,
+    pub at: f64,
+}
+
+/// The notice for fonts a presentation uses that aren't installed, or `None` when all are.
+pub fn missing_fonts_message(fonts: &[String]) -> Option<String> {
+    let names = match fonts {
+        [] => return None,
+        [a] => a.clone(),
+        [a, b] => format!("{a} and {b}"),
+        [a, b, c] => format!("{a}, {b} and {c}"),
+        [a, b, c, rest @ ..] => format!("{a}, {b}, {c} and {} more", rest.len()),
+    };
+    let (it, them) = if fonts.len() == 1 { ("isn't", "it") } else { ("aren't", "them") };
+    Some(format!("{names} {it} installed on this computer. Text that uses {them} is shown in a similar font."))
+}
+
+/// Toast the active presentation's missing fonts, once per opened document.
+pub fn note_missing_fonts(app: &mut SlideApp) {
+    let Some(d) = app.session.active() else { return };
+    if !app.fonts_noted.insert(d.uid) {
+        return;
+    }
+    if let Some(text) = missing_fonts_message(&d.missing_fonts) {
+        app.toast = Some(Toast { text, at: crate::now_ms() });
+    }
+}
+
+pub fn show(app: &mut SlideApp, ctx: &egui::Context) {
+    let Some(toast) = &app.toast else { return };
+    if crate::now_ms() - toast.at > SHOW_MS {
+        app.toast = None;
+        return;
+    }
+    let t = Tokens::get(ctx);
+    let text = toast.text.clone();
+    let mut close = false;
+    egui::Area::new(egui::Id::new("toast")).anchor(Align2::CENTER_BOTTOM, vec2(0.0, -44.0)).order(egui::Order::Foreground).show(ctx, |ui| {
+        egui::Frame::NONE
+            .fill(t.card)
+            .stroke(Stroke::new(1.0, t.card_border))
+            .corner_radius(CornerRadius::same(6))
+            .inner_margin(Margin::symmetric(14, 10))
+            .shadow(egui::epaint::Shadow { offset: [0, 2], blur: 8, spread: 0, color: t.shadow })
+            .show(ui, |ui| {
+                ui.set_max_width(520.0);
+                ui.horizontal(|ui| {
+                    ui.add(egui::Label::new(egui::RichText::new(&text).font(theme::font(13.0)).color(t.text)).wrap());
+                    let (r, resp) = ui.allocate_exact_size(vec2(20.0, 20.0), egui::Sense::click());
+                    resp.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, true, "Close"));
+                    if resp.hovered() {
+                        ui.painter().rect_filled(r, CornerRadius::same(4), t.hover);
+                    }
+                    icons::paint(ui.painter(), r.shrink(3.0), Icon::Close, t.text_dim, false);
+                    if resp.on_hover_text("Close").clicked() {
+                        close = true;
+                    }
+                });
+            });
+    });
+    if close {
+        app.toast = None;
+    } else {
+        ctx.request_repaint_after(std::time::Duration::from_millis(500));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_message_names_the_fonts() {
+        let f = |v: &[&str]| missing_fonts_message(&v.iter().map(|s| s.to_string()).collect::<Vec<_>>());
+        assert_eq!(f(&[]), None);
+        assert_eq!(f(&["Aptos"]).unwrap(), "Aptos isn't installed on this computer. Text that uses it is shown in a similar font.");
+        assert!(f(&["Aptos", "Sora"]).unwrap().starts_with("Aptos and Sora aren't installed"));
+        assert!(f(&["A", "B", "C"]).unwrap().starts_with("A, B and C aren't"));
+        assert!(f(&["A", "B", "C", "D", "E"]).unwrap().starts_with("A, B, C and 2 more aren't"));
+    }
+}

docs/architecture.md

@@ -15,7 +15,7 @@ nothing below L6 uses egui, eframe, winit or rfd.
 
 | Layer | Crates | What they do |
 |---|---|---|
-| L0 | `geom`, `color`; standalone `bitstream`, `matroska`, `ogg`, `opus` | EMU/pt units, transforms, ~150 preset shape generators re-derived from ECMA-376, adjust handles, hit testing; RGB/HSL and DrawingML colour transforms; MKV/WebM and Ogg demuxers, the Opus decoder |
+| L0 | `geom`, `color`; standalone `bitstream`, `matroska`, `ogg`, `opus` | EMU/pt units, transforms, ~180 preset shape generators re-derived from ECMA-376, adjust handles, hit testing; RGB/HSL and DrawingML colour transforms; MKV/WebM and Ogg demuxers, the Opus decoder |
 | L1 | `model`, `fonts`; `h264`, `hevc`, `vp9`, `av1`, `isobmff` | Presentation, masters, layouts, slides, shapes, text, themes, tables, charts, transitions, animations, placeholder inheritance (`resolve`); font database (craft-fonts + system) with metric-compatible substitutes for Office fonts (Carlito for Calibri, Caladea for Cambria, Liberation for Arial/Times); video decoders and the MP4/MOV demuxer |
 | L2 | `text`, `anim`, `format`, `media` | Shaping (HarfRust), UAX #9 bidi, UAX #14 line breaking, autofit, caret hit testing; per-shape animation state over time, the show state machine, transition frame layouts, Morph matching; `.deckcraft` (zip + JSON + media) and outline text; media probing, decoding, mixer and clock |
 | L3 | `render`, `pptx` | `vello_cpu` raster of slides, masters and layouts (fills, outlines, effects, pictures, tables, charts, Morph frames); PPTX import/export from ECMA-376 |

docs/file-format-parity.md

@@ -38,7 +38,7 @@ PowerPoint opens and saves; Viewer = opens only).
 |---|---|---|---|
 | PNG, JPEG, GIF (animated), BMP, TIFF, WebP | yes | yes | `image` 0.25; animated GIFs play since #39 |
 | SVG | yes (with PNG fallback) | **no** | The PNG fallback shows; SVG files can't be inserted |
-| EMF / WMF | yes | **no** | Common in decks made on Windows: blank picture |
+| EMF / WMF | yes | partial | Drawn as vectors (paths, pens, bitmaps); text records inside are skipped |
 | HEIC | yes (macOS) | no | |
 | Audio: MP3, AAC/M4A, ALAC, WAV, AIFF, CAF, FLAC, Ogg Vorbis, Opus | yes (Ogg/Opus partly) | yes | Pure-Rust decoders in `crates/media`, `crates/opus` |
 | WMA | yes (Windows) | embedded, not playable | |
@@ -63,7 +63,7 @@ the round trip even though DeckCraft doesn't model it.
 | Themes: colour, font (Latin/EA/CS), effect schemes, background styles | yes | yes | Unknown theme parts kept |
 | Notes slides and notes master | yes | yes | No notes-master editing view |
 | Handout master | no | no | |
-| Shapes: preset geometry (~150 presets), custom geometry, groups, connectors | yes | yes | Presets re-derived in `crates/geom/src/preset.rs` |
+| Shapes: preset geometry (~180 presets), custom geometry, groups, connectors | yes | yes | Presets re-derived in `crates/geom/src/preset.rs` (and `preset/extra.rs`) |
 | Fills: solid, gradient, picture (stretch/tile/crop), pattern, group | yes | yes | |
 | Lines: dash, compound, caps, joins, arrowheads | yes | yes | |
 | Effects: shadow, glow, soft edges, reflection | yes | yes | |
@@ -93,7 +93,7 @@ the round trip even though DeckCraft doesn't model it.
    embedded fonts, every transition and animation) in a corpus repo, with import → render → export
    → re-import checks in CI and a PowerPoint reference render for each (owner runs PowerPoint).
 2. The round-trip losses above (#70, #74, #77).
-3. EMF/WMF and SVG rendering.
+3. SVG rendering, and text inside EMF/WMF.
 
 ## Revision history
 

docs/gaps.md

@@ -20,7 +20,7 @@ revision history.
 | 1 | PPTX never tested against a corpus of real decks | File format | B | 20–35 | [file-format-parity.md](file-format-parity.md) |
 | 2 | Data loss and crashes on common paths (#60, #40, #59) | Stability | B | 6–12 | this file |
 | 3 | PPTX round trip drops comment threads, media options, rewind (#70, #74, #77) | File format | B | 3–6 | [file-format-parity.md](file-format-parity.md) |
-| 4 | EMF/WMF and SVG pictures don't render | File format | B | 8–14 | [file-format-parity.md](file-format-parity.md) |
+| 4 | SVG pictures don't render (EMF/WMF do) | File format | B | 8–14 | [file-format-parity.md](file-format-parity.md) |
 | 5 | No localization: English only | Localization | B (infra + 5 languages) | 55–90 | [localization-parity.md](localization-parity.md) |
 | 6 | No printing | Feature | B | 5–8 | [file-format-parity.md](file-format-parity.md) |
 | 7 | Fonts: only Regular, Bold and Italic faces (#69) | Feature | B | 3–5 | [ui-parity.md](ui-parity.md) |
@@ -75,14 +75,14 @@ Detail in [file-format-parity.md](file-format-parity.md).
 - **Impact:** a deck opened and saved silently loses review state and show behaviour.
 - **Estimate:** 3–6 h. **Beta blocker.**
 
-### EMF/WMF and SVG pictures don't render
+### SVG pictures don't render
 - **Evidence:** `crates/render/src/images.rs` decodes through `image` 0.25 (PNG, JPEG, WebP, GIF,
-  TIFF, BMP); nothing reads EMF, WMF or SVG. Decks from Windows often hold EMF (pasted charts,
-  Visio, logos); PowerPoint's Insert Icons stores SVG with a PNG fallback.
-- **Impact:** blank pictures in real decks; SVG icons show only their raster fallback, and SVG files
-  can't be inserted.
-- **Estimate:** 8–14 h (an SVG renderer through `resvg`-style crates, an EMF/WMF record player for
-  the common records). **Beta blocker** for EMF.
+  TIFF, BMP), and EMF/WMF through `deckcraft-metafile` (ported from WordCraft: paths, fills, pens
+  and bitmaps; text records are skipped). Nothing reads SVG; PowerPoint's Insert Icons stores SVG
+  with a PNG fallback.
+- **Impact:** SVG icons show only their raster fallback, and SVG files can't be inserted. Text
+  drawn inside an EMF/WMF is missing.
+- **Estimate:** 4–8 h (an SVG renderer through `resvg`-style crates); EMF text records 2–4 h.
 
 ### Template, slide-show and macro variants are saved as plain `.pptx`
 - **Evidence:** `crates/pptx/src/write/mod.rs` always writes the

docs/roadmap.md

@@ -16,7 +16,7 @@ points and lead the beta plan.
 | Core workflow | Works end to end? | Evidence | Hours to full pass |
 |---|---|---|---|
 | Build a deck from scratch (theme, layouts, titles and bullets, shapes, pictures from file), save, close and reopen it | yes | Commands for all of it; `.deckcraft` and `.pptx` round-trip tests (`crates/pptx/tests/roundtrip.rs`, `crates/format`); AutoRecover. Close discards edits without asking (#60, PR #75); image *paste* fails on Windows/Linux (#53), though insert-from-file works | 1–3 |
-| Open a colleague's `.pptx`, edit it, save it back as `.pptx` that PowerPoint opens | partial (not blocking) | The reader is lenient and keeps unknown objects. Files open in PowerPoint without repair (checked 2026-10-06). But only generated decks have been tested; EMF/WMF pictures render blank; comment threads, media options and rewind are lost (#70, #74, #77) | 31–55 |
+| Open a colleague's `.pptx`, edit it, save it back as `.pptx` that PowerPoint opens | partial (not blocking) | The reader is lenient and keeps unknown objects. Files open in PowerPoint without repair (checked 2026-10-06). But only generated decks have been tested; text inside EMF/WMF pictures is missing; comment threads, media options and rewind are lost (#70, #74, #77) | 31–55 |
 | Present: full-screen show with transitions, animations, media, presenter view with notes, next slide and timer | yes | 48/48 transitions, 64 effects, triggers, builds, media playback, presenter window. Presenter view isn't placed on the second display automatically (drag it there) | 3–5 |
 | Add business content: tables, charts with their data, simple diagrams | partial (not blocking) | Tables with styles, merge/split, all D or P. Charts insert with the common types and edit data in the Chart Data dialog (P0 partial); SmartArt is basic (pre-drawn shapes) | 12–20 |
 | Share the deck: PDF of slides, notes or handouts; images | yes | `file.export` PDF with text layer, links, bookmarks, handouts 1–9; PNG/JPEG. Artwork is raster in the PDF; no direct print (print the PDF) | 10–16 |

docs/target-app-parity.md

@@ -212,7 +212,7 @@ Carried from the 2026-10-07 ROADMAP status and updated with what has landed sinc
   header/footer fields, embedded media, unlimited undo on shared slide snapshots.
 - **Themes:** 8 original themes with colour and font schemes, custom colours and fonts,
   backgrounds (solid, gradient, picture, pattern), slide size presets.
-- **Shapes:** ~150 preset geometries with adjustment handles, text boxes, pictures (crop,
+- **Shapes:** ~180 preset geometries with adjustment handles, text boxes, pictures (crop,
   corrections, animated GIFs that play and pause), tables with styles, charts (column, bar, line,
   area, pie, doughnut, scatter and more), basic SmartArt, groups, connectors glued to sites,
   freeform/curve/scribble, merge shapes, ink, action buttons, WordArt; flipped shapes keep their

xtask/src/layers.rs

@@ -47,6 +47,8 @@ pub const TABLE: &[(&str, Class)] = &[
     ("isobmff", Class::Layer(1)),
     ("media", Class::Layer(2)),
     ("color", Class::Layer(0)),
+    // WMF/EMF reader (ported from WordCraft).
+    ("metafile", Class::Layer(0)),
     ("model", Class::Layer(1)),
     ("fonts", Class::Layer(1)),
     ("text", Class::Layer(2)),